www.ctslink.com Open in urlscan Pro
159.45.6.40 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.ctslink.com/
Effective URL:
https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON...
Submission: On June 26 via manual (June 26th 2019, 9:14:21 am UTC) from FR

Summary HTTP 36 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 36 HTTP transactions. The main IP is 159.45.6.40, located in Concord, United States and belongs to WELLSFARGO-10837 - Wells Fargo & Company, US. The main domain is www.ctslink.com.
TLS certificate: Issued by Wells Fargo Public Trust Certificatio... on February 7th 2018. Valid for: 2 years.

This is the only time www.ctslink.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 20	159.45.6.40 159.45.6.40	10837 (WELLSFARG...) (WELLSFARGO-10837 - Wells Fargo & Company)
2	159.45.6.12 159.45.6.12	10837 (WELLSFARG...) (WELLSFARGO-10837 - Wells Fargo & Company)
1	104.109.70.200 104.109.70.200	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
7	159.45.66.145 159.45.66.145	4196 (WELLSFARG...) (WELLSFARGO-4196 - Wells Fargo & Company)
6	2a02:26f0:6c0... 2a02:26f0:6c00:19d::1fa8	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	159.45.161.35 159.45.161.35	10837 (WELLSFARG...) (WELLSFARGO-10837 - Wells Fargo & Company)
36	6

20 159.45.6.40 (Concord, United States) 1 redirects

ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US)

www.ctslink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 159.45.6.12 (Concord, United States)

ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US)

www.accesswca.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.109.70.200 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a104-109-70-200.deploy.static.akamaitechnologies.com

www01.wellsfargomedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 159.45.66.145 (United States)

ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US)

www.wellsfargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:26f0:6c00:19d::1fa8 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

ceomedia.wf.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 159.45.161.35 (United States)

ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US)

wifp.wellsfargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
20	ctslink.com 1 redirects www.ctslink.com	1 MB
8	wellsfargo.com www.wellsfargo.com wifp.wellsfargo.com	41 KB
6	wf.com ceomedia.wf.com	233 KB
2	accesswca.com www.accesswca.com	272 KB
1	wellsfargomedia.com www01.wellsfargomedia.com	4 KB
36	5

	Domain	Requested by
20	www.ctslink.com	1 redirects www.ctslink.com
7	www.wellsfargo.com	www.ctslink.com
6	ceomedia.wf.com	www.accesswca.com ceomedia.wf.com
2	www.accesswca.com	www.ctslink.com ceomedia.wf.com
1	wifp.wellsfargo.com	ceomedia.wf.com
1	www01.wellsfargomedia.com	www.ctslink.com
36	6

This site contains links to these domains. Also see Links.

Domain
www.wellsfargo.com
www.securitieslink.com
direct.ctslink.com

Subject Issuer	Validity	Valid
www.ctslink.com Wells Fargo Public Trust Certification Authority 01 G2	`2018-02-07` - `2020-02-08`	2 years	crt.sh
www.accesswca.com Wells Fargo Public Trust Certification Authority 01 G2	`2019-02-20` - `2020-01-27`	a year	crt.sh
www01.wellsfargomedia.com GeoTrust RSA CA 2018	`2019-02-19` - `2020-05-20`	a year	crt.sh
www.wellsfargo.com DigiCert Global CA G2	`2019-02-08` - `2021-02-08`	2 years	crt.sh
ceomedia.wf.com DigiCert SHA2 Secure Server CA	`2019-02-18` - `2020-05-19`	a year	crt.sh
wifp.wellsfargo.com Wells Fargo Public Trust Certification Authority 01 G2	`2017-12-19` - `2019-12-20`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
Frame ID: 949E3B69C97ED7E9F162461B93E11843
Requests: 36 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.ctslink.com/ HTTP 302
https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208... Page URL

Detected technologies

RequireJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

script /require.*\.js/i

Page Statistics

36
Requests

100 %
HTTPS

17 %
IPv6

5
Domains

6
Subdomains

6
IPs

3
Countries

2023 kB
Transfer

2783 kB
Size

0
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://www.wellsfargo.com/about/
Title: About Wells Fargo

Search URL Search Domain Scan URL

URL: https://www.securitieslink.com/
Title: SecuritiesLink

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/com/corporate-trust/specialized-asset-services
Title: More About Us

Search URL Search Domain Scan URL

URL: https://direct.ctslink.com/z/listfiles.html?lib=BMA5
Title: Central library for payment, factor & redemption file publications.

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy_security/fraud/?_requestid=13968
Title: Fraud Information Center

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.ctslink.com/ HTTP 302
https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

36 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request

Cookie set welcome.html Show response
www.ctslink.com/a/
Redirect Chain

https://www.ctslink.com/
https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2fl...

17 KB
18 KB

186ms
185ms

Document
text/html

159.45.6.40
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.6.40 Concord, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Resource Hash

58e352b1564d9adc16ec41e8f0be32cc22ad383c8139dbad53398212c9db69af

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' https://.wellsfargo.com https://.wf.com https://.accesswca.com https://.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Host: www.ctslink.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate, br
Cookie: TLTHID=BC3835BA97F2109784AED836280018F2; TLTSID=BC3835BA97F2109784AED836280018F2; ctslink_443_infra_2=!MsiqTw7l6PWpucqUmBty94dbeWuYsi9hM0HKGNsJo9guJASeMhQvrXVYwhC1VOdR8mWfPoox+RyLtA==; TS01518544=01baf59c836c6202bc58c0351210f80823c751a826744ecc004d2fd13f8d4f610eb20f041ae3c6c8816c0e660d7b0669547e5bd626; TS012a29ed=01baf59c83ba54bcefd8f5d3f603079d8c5ab2d4a64008d97a142af6c636aab9b2f49e83ccde53146d3048543e886bec1f8dfcf3ff89b69c6cd4d7105456b6415e464f60ca; ctslink_443_infra_1=!BnQmU01Nxn/WmL6UmBty94dbeWuYssYumWx2/3lbCjJZeD6eJNGA8ShyWCi/BpCsf0C+mvQWnQlw
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:00 GMT
Set-Cookie: TLTHID=BC4C33B297F2109784AFD836280018F2; Path=/; Domain=.ctslink.com CTSLK=XfSTEDNBnUZ7mEH9qOPoj3dIkRjFmbXdCiZbvUEIL2ehS0hdPVAr!-232217925; path=/; secure; HttpOnly TS01518544=01baf59c832ff9f4aa8fd6677faaf930f742f477b6744ecc004d2fd13f8d4f610eb20f041a401c4f46a760e777a05e6802d0082c75d17ddc75b823bfd127af033bae332867; Path=/ TS012a29ed=01baf59c83c07e1a717b4b1f112f3975de2fe6c7c24008d97a142af6c636aab9b2f49e83cc4e0b48b765154b8e20b3c920accd7537190e7967225c4ab24b755e433a683235; path=/; domain=.ctslink.com
HostName: wpvre99a0001
Cache-Control: no-cache no-store must-revalidate no-transform
Pragma: no-cache
Expires: -1
Content-Security-Policy: script-src 'self' https://*.wellsfargo.com https://*.wf.com https://*.accesswca.com https://*.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Language: en-US
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge
X-Frame-Options: DENY
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Content-Type: text/html;charset=iso-8859-1
Transfer-Encoding: chunked

Redirect headers

Date: Wed, 26 Jun 2019 09:14:00 GMT
Set-Cookie: TLTHID=BC3835BA97F2109784AED836280018F2; Path=/; Domain=.ctslink.com TLTSID=BC3835BA97F2109784AED836280018F2; Path=/; Domain=.ctslink.com ctslink_443_infra_2=!MsiqTw7l6PWpucqUmBty94dbeWuYsi9hM0HKGNsJo9guJASeMhQvrXVYwhC1VOdR8mWfPoox+RyLtA==; path=/; Httponly; Secure TS01518544=01baf59c836c6202bc58c0351210f80823c751a826744ecc004d2fd13f8d4f610eb20f041ae3c6c8816c0e660d7b0669547e5bd626; Path=/ TS012a29ed=01baf59c83ba54bcefd8f5d3f603079d8c5ab2d4a64008d97a142af6c636aab9b2f49e83ccde53146d3048543e886bec1f8dfcf3ff89b69c6cd4d7105456b6415e464f60ca; path=/; domain=.ctslink.com ctslink_443_infra_1=!BnQmU01Nxn/WmL6UmBty94dbeWuYssYumWx2/3lbCjJZeD6eJNGA8ShyWCi/BpCsf0C+mvQWnQlw; path=/; Httponly; Secure
Cache-Control: no-store
HostName: wpvre99a0001
Location: /a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
Content-Length: 525
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK global.css
www.ctslink.com/img/corptrust/ 139 KB
140 KB 253ms
148ms Stylesheet
text/css 159.45.6.40
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ctslink.com/img/corptrust/global.css

Requested by

Host: www.ctslink.com
URL: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.6.40 Concord, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Resource Hash

02c11b20c746522d3b39463818eb1b102a24a049cde32e700d02ebe1bce8b6fc

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' https://.wellsfargo.com https://.wf.com https://.accesswca.com https://.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Type: text/css
HostName: wpvre99a0001
Cache-Control: max-age=3600
Transfer-Encoding: chunked
X-UA-Compatible: IE=edge
Content-Security-Policy: script-src 'self' https://*.wellsfargo.com https://*.wf.com https://*.accesswca.com https://*.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Connection: Keep-Alive
Keep-Alive: timeout=15, max=98
X-XSS-Protection: 1; mode=block
Expires: -1

GET
H/1.1 200
OK jquery-ui.custom.css
www.ctslink.com/img/corptrust/ 31 KB
32 KB 544ms
167ms Stylesheet
text/css 159.45.6.40
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ctslink.com/img/corptrust/jquery-ui.custom.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.6.40 Concord, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Resource Hash

3fe8062f4a3efc16c2be0c7819078d53cc831d81166493171ecf25dbd472c3d2

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' https://.wellsfargo.com https://.wf.com https://.accesswca.com https://.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Type: text/css
HostName: wpvre99a0001
Cache-Control: max-age=3600
Transfer-Encoding: chunked
X-UA-Compatible: IE=edge
Content-Security-Policy: script-src 'self' https://*.wellsfargo.com https://*.wf.com https://*.accesswca.com https://*.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Connection: Keep-Alive
Keep-Alive: timeout=15, max=100
X-XSS-Protection: 1; mode=block
Expires: -1

GET
H/1.1 200
OK commercial.css
www.ctslink.com/img/corptrust/ 4 KB
5 KB 546ms
169ms Stylesheet
text/css 159.45.6.40
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ctslink.com/img/corptrust/commercial.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.6.40 Concord, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Resource Hash

3b1a5a6628a59442e97f24b29aa5d5fa8ea5833340782bb1887aac1ec6a5d962

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' https://.wellsfargo.com https://.wf.com https://.accesswca.com https://.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Type: text/css
HostName: wpvre99a0001
Cache-Control: max-age=3600
X-UA-Compatible: IE=edge
Content-Security-Policy: script-src 'self' https://*.wellsfargo.com https://*.wf.com https://*.accesswca.com https://*.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Connection: Keep-Alive
Keep-Alive: timeout=15, max=100
Content-Length: 3860
X-XSS-Protection: 1; mode=block
Expires: -1

GET
H/1.1 200
OK ct.css
www.ctslink.com/img/corptrust/ 13 KB
14 KB 547ms
169ms Stylesheet
text/css 159.45.6.40
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ctslink.com/img/corptrust/ct.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.6.40 Concord, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Resource Hash

1bac50587be7dd42d1251e834dfd4a3514a883fa180af62dff73efee960fc832

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' https://.wellsfargo.com https://.wf.com https://.accesswca.com https://.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Type: text/css
HostName: wpvre99a0001
Cache-Control: max-age=3600
Transfer-Encoding: chunked
X-UA-Compatible: IE=edge
Content-Security-Policy: script-src 'self' https://*.wellsfargo.com https://*.wf.com https://*.accesswca.com https://*.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Connection: Keep-Alive
Keep-Alive: timeout=15, max=100
X-XSS-Protection: 1; mode=block
Expires: -1

GET
H/1.1 200
OK javascript_lib.js Show response
www.ctslink.com/global/ 1 KB
2 KB 627ms
136ms Script
text/javascript 159.45.6.40
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ctslink.com/global/javascript_lib.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.6.40 Concord, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Resource Hash

eb85f7de4cd962979a9dd759e076b53d513c447bf2840a1e8fc59d9716327473

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' https://.wellsfargo.com https://.wf.com https://.accesswca.com https://.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
HostName: wpvre99a0001
Connection: Keep-Alive
Content-Length: 1310
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge
Pragma: no-cache
Last-Modified: Thu, 09 May 2019 19:08:52 GMT
X-Frame-Options: DENY
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate, no-transform
Content-Security-Policy: script-src 'self' https://*.wellsfargo.com https://*.wf.com https://*.accesswca.com https://*.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=97
Expires: -1

GET
H/1.1 200
OK javascript_fns.js Show response
www.ctslink.com/global/ 772 B
2 KB 682ms
134ms Script
text/javascript 159.45.6.40
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ctslink.com/global/javascript_fns.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.6.40 Concord, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Resource Hash

bdce3f64d3247c9100093b38bcb19d3eee6be03e9f9a6351009f7fc5065694ca

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' https://.wellsfargo.com https://.wf.com https://.accesswca.com https://.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
HostName: wpvre99a0001
Connection: Keep-Alive
Content-Length: 772
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge
Pragma: no-cache
Last-Modified: Thu, 09 May 2019 19:08:52 GMT
X-Frame-Options: DENY
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate, no-transform
Content-Security-Policy: script-src 'self' https://*.wellsfargo.com https://*.wf.com https://*.accesswca.com https://*.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=99
Expires: -1

GET
H/1.1 200 wca-widget.min.js Show response
www.accesswca.com/wcawidget/build/2.0/ 4 KB
5 KB 4033ms
157ms Script
application/javascript 159.45.6.12
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.accesswca.com/wcawidget/build/2.0/wca-widget.min.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.6.12 Concord, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Web Server /

Resource Hash

2b7a594b7fe0ca8c16d0a9a54ac16db317d3ff63166f9133bfa712790bd12cb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 26 Jun 2019 09:14:04 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Wed, 24 Apr 2019 21:42:22 GMT
Server: Web Server
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Cache-Control: no-cache, no-store, no-cache, must-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 4281
X-XSS-Protection: 1; mode=block, 1; mode=block
Expires: -1

GET
H/1.1 200
OK wca-widget-init.js Show response
www.ctslink.com/global/ 2 KB
3 KB 683ms
135ms Script
text/javascript 159.45.6.40
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ctslink.com/global/wca-widget-init.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.6.40 Concord, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Resource Hash

26d2ed2b7dd5c16e22a418fc234b93bfe21f9d5a5bbcdacdfaa89bf8313fd107

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' https://.wellsfargo.com https://.wf.com https://.accesswca.com https://.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
HostName: wpvre99a0001
Connection: Keep-Alive
Content-Length: 2355
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge
Pragma: no-cache
Last-Modified: Thu, 09 May 2019 19:08:52 GMT
X-Frame-Options: DENY
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate, no-transform
Content-Security-Policy: script-src 'self' https://*.wellsfargo.com https://*.wf.com https://*.accesswca.com https://*.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=99
Expires: -1

GET
H/1.1 200
OK anticlickjack.js Show response
www.ctslink.com/global/ 206 B
1 KB 765ms
137ms Script
text/javascript 159.45.6.40
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ctslink.com/global/anticlickjack.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.6.40 Concord, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Resource Hash

2dd1e20a794a7f761994974be8655c36ea5685259444c30d26d887a5457e7c52

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' https://.wellsfargo.com https://.wf.com https://.accesswca.com https://.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
HostName: wpvre99a0001
Connection: Keep-Alive
Content-Length: 206
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge
Pragma: no-cache
Last-Modified: Thu, 09 May 2019 19:08:52 GMT
X-Frame-Options: DENY
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate, no-transform
Content-Security-Policy: script-src 'self' https://*.wellsfargo.com https://*.wf.com https://*.accesswca.com https://*.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=96
Expires: -1

GET
H/1.1 200
OK ctAlerts.js Show response
www.ctslink.com/global/ 202 B
1 KB 812ms
147ms Script
text/javascript 159.45.6.40
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ctslink.com/global/ctAlerts.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.6.40 Concord, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Resource Hash

95ce78e538c31052ace9c3c0047a4b05a78bf55c4f34436928bfe67c08f03d20

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' https://.wellsfargo.com https://.wf.com https://.accesswca.com https://.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
HostName: wpvre99a0001
Connection: Keep-Alive
Content-Length: 202
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge
Pragma: no-cache
Last-Modified: Thu, 09 May 2019 19:08:52 GMT
X-Frame-Options: DENY
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate, no-transform
Content-Security-Policy: script-src 'self' https://*.wellsfargo.com https://*.wf.com https://*.accesswca.com https://*.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=99
Expires: -1

GET
H/1.1 200
OK timeout.js Show response
www.ctslink.com/global/ 728 B
2 KB 823ms
141ms Script
text/javascript 159.45.6.40
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ctslink.com/global/timeout.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.6.40 Concord, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Resource Hash

fca73d32371667fb593a78fe91d3906a3dde9e7032e8b57b975de78779f75818

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' https://.wellsfargo.com https://.wf.com https://.accesswca.com https://.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
HostName: wpvre99a0001
Connection: Keep-Alive
Content-Length: 728
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge
Pragma: no-cache
Last-Modified: Thu, 09 May 2019 19:08:52 GMT
X-Frame-Options: DENY
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate, no-transform
Content-Security-Policy: script-src 'self' https://*.wellsfargo.com https://*.wf.com https://*.accesswca.com https://*.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=98
Expires: -1

GET
H/1.1 200
OK wf-logo.gif
www01.wellsfargomedia.com/assets/images/global/ 4 KB
4 KB 2593ms
19ms Image
image/gif 104.109.70.200
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www01.wellsfargomedia.com/assets/images/global/wf-logo.gif

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.70.200 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-70-200.deploy.static.akamaitechnologies.com

Software

KONICHIWA/2.0 /

Resource Hash

edc5ee3b590dae17b0eb19063c34680c15ee144d13583d006e6a7976b69cd2db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Content-Type-Options: nosniff
Last-Modified: Sat, 15 Nov 2014 14:20:03 GMT
Server: KONICHIWA/2.0
ETag: "e86-507e670fc2ac0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/gif
Cache-Control: max-age=1800
Date: Wed, 26 Jun 2019 09:14:03 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3718
X-XSS-Protection: 1; mode=block
Expires: Wed, 26 Jun 2019 09:44:03 GMT

GET
H/1.1 200
OK ctslink.gif
www.ctslink.com/img/header/ 1 KB
2 KB 183ms
165ms Image
image/gif 159.45.6.40
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ctslink.com/img/header/ctslink.gif

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.6.40 Concord, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Resource Hash

e27ee0dcbf3e8177889b2b11b651ffd5dda1994d88f1de01ee014d10e3ae63b1

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' https://.wellsfargo.com https://.wf.com https://.accesswca.com https://.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Type: image/gif
HostName: wpvre99a0001
Cache-Control: max-age=3600
X-UA-Compatible: IE=edge
Content-Security-Policy: script-src 'self' https://*.wellsfargo.com https://*.wf.com https://*.accesswca.com https://*.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Connection: Keep-Alive
Keep-Alive: timeout=15, max=98
Content-Length: 1362
X-XSS-Protection: 1; mode=block
Expires: -1

GET
H/1.1 200
OK icon_PDF.gif
www.ctslink.com/img/icons/ 349 B
1 KB 457ms
150ms Image
image/gif 159.45.6.40
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ctslink.com/img/icons/icon_PDF.gif

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.6.40 Concord, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Resource Hash

75ee5d40befff7f45c0055222febcbe26fe73aed23a8b576886e6d5da60c90d6

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' https://.wellsfargo.com https://.wf.com https://.accesswca.com https://.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:02 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Type: image/gif
HostName: wpvre99a0001
Cache-Control: max-age=3600
X-UA-Compatible: IE=edge
Content-Security-Policy: script-src 'self' https://*.wellsfargo.com https://*.wf.com https://*.accesswca.com https://*.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Connection: Keep-Alive
Keep-Alive: timeout=15, max=96
Content-Length: 349
X-XSS-Protection: 1; mode=block
Expires: -1

GET
H/1.1 200
OK video.js Show response
www.ctslink.com/img/corptrust/ 64 KB
65 KB 259ms
166ms Script
text/javascript 159.45.6.40
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ctslink.com/img/corptrust/video.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.6.40 Concord, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Resource Hash

8071d2e9ee7ab2fbbbd8925d2d7fa329ef353374cbbb205ee05a98576fdee4eb

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' https://.wellsfargo.com https://.wf.com https://.accesswca.com https://.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Type: text/javascript
HostName: wpvre99a0001
Cache-Control: max-age=3600
Transfer-Encoding: chunked
X-UA-Compatible: IE=edge
Content-Security-Policy: script-src 'self' https://*.wellsfargo.com https://*.wf.com https://*.accesswca.com https://*.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Connection: Keep-Alive
Keep-Alive: timeout=15, max=95
X-XSS-Protection: 1; mode=block
Expires: -1

GET
H/1.1 200
OK jquery.js Show response
www.ctslink.com/img/corptrust/ 287 KB
288 KB 331ms
161ms Script
text/javascript 159.45.6.40
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ctslink.com/img/corptrust/jquery.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.6.40 Concord, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Resource Hash

be1fbf9e9d377ed53864ec58dde302b1dc16a7d3170395e731e7b6cdc1193a8a

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' https://.wellsfargo.com https://.wf.com https://.accesswca.com https://.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Type: text/javascript
HostName: wpvre99a0001
Cache-Control: max-age=3600
Transfer-Encoding: chunked
X-UA-Compatible: IE=edge
Content-Security-Policy: script-src 'self' https://*.wellsfargo.com https://*.wf.com https://*.accesswca.com https://*.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Connection: Keep-Alive
Keep-Alive: timeout=15, max=98
X-XSS-Protection: 1; mode=block
Expires: -1

GET
H/1.1 200
OK jquery-ui.js Show response
www.ctslink.com/img/corptrust/ 527 KB
529 KB 244ms
164ms Script
text/javascript 159.45.6.40
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ctslink.com/img/corptrust/jquery-ui.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.6.40 Concord, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Resource Hash

b1c26d407e1ca174bf356cf7ffa935ce2441c129c2105d7ef12a28090a0eefbf

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' https://.wellsfargo.com https://.wf.com https://.accesswca.com https://.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Type: text/javascript
HostName: wpvre99a0001
Cache-Control: max-age=3600
Transfer-Encoding: chunked
X-UA-Compatible: IE=edge
Content-Security-Policy: script-src 'self' https://*.wellsfargo.com https://*.wf.com https://*.accesswca.com https://*.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Connection: Keep-Alive
Keep-Alive: timeout=15, max=97
X-XSS-Protection: 1; mode=block
Expires: -1

GET
H/1.1 200
OK global.js Show response
www.ctslink.com/img/corptrust/ 271 KB
273 KB 164ms
160ms Script
text/javascript 159.45.6.40
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ctslink.com/img/corptrust/global.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.6.40 Concord, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Resource Hash

71cc0bab512c09c1de31233e2694ed81aef7a39c84abeba6af8e7d501bad2eb6

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' https://.wellsfargo.com https://.wf.com https://.accesswca.com https://.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Type: text/javascript
HostName: wpvre99a0001
Cache-Control: max-age=3600
Transfer-Encoding: chunked
X-UA-Compatible: IE=edge
Content-Security-Policy: script-src 'self' https://*.wellsfargo.com https://*.wf.com https://*.accesswca.com https://*.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Connection: Keep-Alive
Keep-Alive: timeout=15, max=97
X-XSS-Protection: 1; mode=block
Expires: -1

GET
H/1.1 200
OK media-audio.js Show response
www.ctslink.com/img/corptrust/ 91 KB
92 KB 367ms
167ms Script
text/javascript 159.45.6.40
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ctslink.com/img/corptrust/media-audio.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.6.40 Concord, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Resource Hash

651340e9240afadeb01bbdc9b15e239059e12d3275bfbf6466d0675efbdbac76

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' https://.wellsfargo.com https://.wf.com https://.accesswca.com https://.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:02 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Type: text/javascript
HostName: wpvre99a0001
Cache-Control: max-age=3600
Transfer-Encoding: chunked
X-UA-Compatible: IE=edge
Content-Security-Policy: script-src 'self' https://*.wellsfargo.com https://*.wf.com https://*.accesswca.com https://*.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Connection: Keep-Alive
Keep-Alive: timeout=15, max=94
X-XSS-Protection: 1; mode=block
Expires: -1

GET
H/1.1 200
OK media-custom-audio.js Show response
www.ctslink.com/img/corptrust/ 239 B
1 KB 639ms
149ms Script
text/javascript 159.45.6.40
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ctslink.com/img/corptrust/media-custom-audio.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.6.40 Concord, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Resource Hash

920492a843d91c4987dae43d2315bd5ddc00fb43d430f05c0b906ac8f65a0555

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' https://.wellsfargo.com https://.wf.com https://.accesswca.com https://.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:02 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Type: text/javascript
HostName: wpvre99a0001
Cache-Control: max-age=3600
X-UA-Compatible: IE=edge
Content-Security-Policy: script-src 'self' https://*.wellsfargo.com https://*.wf.com https://*.accesswca.com https://*.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Connection: Keep-Alive
Keep-Alive: timeout=15, max=93
Content-Length: 239
X-XSS-Protection: 1; mode=block
Expires: -1

GET
H/1.1 200
OK search_bar_gray_button_45x30.png
www.wellsfargo.com/assets/images/css/template/ 1 KB
2 KB 596ms
132ms Image
image/png 159.45.66.145
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.wellsfargo.com/assets/images/css/template/search_bar_gray_button_45x30.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.66.145 , United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

e20b059c7051277dbb18d5ece18584c70670bc8afd3639cecf2587b391bd6bb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/img/corptrust/global.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 14 Sep 2014 00:00:35 GMT
Server: KONICHIWA/2.0
X-Frame-Options: SAMEORIGIN
ETag: "470-502fb3521aec0"
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Type: image/png
Cache-Control: max-age=1800
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=64
Content-Length: 1136
X-XSS-Protection: 1; mode=block
Expires: Wed, 26 Jun 2019 09:44:05 GMT

GET
H/1.1 200
OK btn-icon-search.png
www.wellsfargo.com/assets/images/css/template/ 1 KB
2 KB 726ms
135ms Image
image/png 159.45.66.145
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.wellsfargo.com/assets/images/css/template/btn-icon-search.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.66.145 , United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

da38fd7d6d2e1425dc8fecba13e64cd220d4f34d7c7d3ae76f9916d3b489b5d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/img/corptrust/global.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 14 Sep 2014 00:00:35 GMT
Server: KONICHIWA/2.0
X-Frame-Options: SAMEORIGIN
ETag: "50f-502fb3521aec0"
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Type: image/png
Cache-Control: max-age=1800
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=56
Content-Length: 1295
X-XSS-Protection: 1; mode=block
Expires: Wed, 26 Jun 2019 09:44:05 GMT

GET
H/1.1 200
OK bg-fat-nav.png
www.wellsfargo.com/assets/images/css/template/ 584 B
1 KB 724ms
130ms Image
image/png 159.45.66.145
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.wellsfargo.com/assets/images/css/template/bg-fat-nav.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.66.145 , United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

cde3c7723f8f101df28d59fc04cd49966eba933bc7ff600ad0fb1bda9dcec454

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/img/corptrust/global.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 24 May 2013 20:02:30 GMT
Server: KONICHIWA/2.0
X-Frame-Options: SAMEORIGIN
ETag: "248-4dd7c47600180"
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Type: image/png
Cache-Control: max-age=1800
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=74
Content-Length: 584
X-XSS-Protection: 1; mode=block
Expires: Wed, 26 Jun 2019 09:44:05 GMT

GET
H/1.1 200
OK bg-footer.png
www.wellsfargo.com/assets/images/css/template/ 915 B
1 KB 854ms
130ms Image
image/png 159.45.66.145
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.wellsfargo.com/assets/images/css/template/bg-footer.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.66.145 , United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

136517b00afcfc85af33eaa62312e3900afcd3c220501b086a31911d08e49d53

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/img/corptrust/global.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sat, 10 Feb 2018 14:34:29 GMT
Server: KONICHIWA/2.0
X-Frame-Options: SAMEORIGIN
ETag: "393-564dc8adee740"
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Type: image/png
Cache-Control: max-age=1800
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=70
Content-Length: 915
X-XSS-Protection: 1; mode=block
Expires: Wed, 26 Jun 2019 09:44:05 GMT

GET
H/1.1 200
OK hp_signon_bg.png
www.wellsfargo.com/assets/images/homepage/ 3 KB
3 KB 856ms
134ms Image
image/png 159.45.66.145
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.wellsfargo.com/assets/images/homepage/hp_signon_bg.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.66.145 , United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

15f93d64144d386c80082dd9f918e1f57878e15298954c250a463bb2e29a524b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/img/corptrust/global.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 24 May 2013 20:09:28 GMT
Server: KONICHIWA/2.0
X-Frame-Options: SAMEORIGIN
ETag: "aea-4dd7c604a2e00"
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Type: image/png
Cache-Control: max-age=1800
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=81
Content-Length: 2794
X-XSS-Protection: 1; mode=block
Expires: Wed, 26 Jun 2019 09:44:05 GMT

GET
H/1.1 200
OK bg-prod1photo.png
www.wellsfargo.com/assets/images/css/template/ 1009 B
1 KB 981ms
129ms Image
image/png 159.45.66.145
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.wellsfargo.com/assets/images/css/template/bg-prod1photo.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.66.145 , United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

04e3335bd8c3169c969d3eee07c46471537f461af3efc1c8a540a31411b0a4aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/img/corptrust/global.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 24 May 2013 20:02:36 GMT
Server: KONICHIWA/2.0
X-Frame-Options: SAMEORIGIN
ETag: "3f1-4dd7c47bb8f00"
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Type: image/png
Cache-Control: max-age=1800
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=30
Content-Length: 1009
X-XSS-Protection: 1; mode=block
Expires: Wed, 26 Jun 2019 09:44:05 GMT

GET
H/1.1 200
OK service-module-divider.png
www.wellsfargo.com/assets/images/css/template/ 1 KB
2 KB 559ms
141ms Image
image/png 159.45.66.145
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.wellsfargo.com/assets/images/css/template/service-module-divider.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.66.145 , United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

7aa6da661575add37ac3b7f5aac259a35b60560887f4380378ee2e0d19515cf2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ctslink.com/img/corptrust/global.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 24 May 2013 20:03:00 GMT
Server: KONICHIWA/2.0
X-Frame-Options: SAMEORIGIN
ETag: "40b-4dd7c4929c500"
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Type: image/png
Cache-Control: max-age=1800
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=30
Content-Length: 1035
X-XSS-Protection: 1; mode=block
Expires: Wed, 26 Jun 2019 09:44:05 GMT

GET
H2 200 wf2-min.js Show response
ceomedia.wf.com/wria/2.16.2/build/wf2/ 266 KB
72 KB 1049ms
926ms Script
application/javascript 2a02:26f0:6c00:19d::1fa8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://ceomedia.wf.com/wria/2.16.2/build/wf2/wf2-min.js

Requested by

Host: www.accesswca.com
URL: https://www.accesswca.com/wcawidget/build/2.0/wca-widget.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:19d::1fa8 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Web Server /

Resource Hash

4d1f1db854995e6c2f366a876e5fb4b487df3ca357b84ddfa4f9d6451994ca90

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Fri, 19 Jan 2018 03:00:16 GMT
server: Web Server
x-frame-options: SAMEORIGIN
etag: "42800-5631847a65000-gzip"
vary: Accept-Encoding
content-type: application/javascript
status: 200
date: Wed, 26 Jun 2019 09:14:07 GMT
accept-ranges: bytes
x-xss-protection: 1; mode=block, 1; mode=block

GET
H/1.1 200 wria-writeups.min.js Show response
www.accesswca.com/wcawidget/build/2.10/ 265 KB
266 KB 153ms
153ms Script
application/javascript 159.45.6.12
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.accesswca.com/wcawidget/build/2.10/wria-writeups.min.js

Requested by

Host: ceomedia.wf.com
URL: https://ceomedia.wf.com/wria/2.16.2/build/wf2/wf2-min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.6.12 Concord, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Web Server /

Resource Hash

7f631964cc3f9e43b5d015f393c668499e1beb769b82e6ee9fd1e02149bf7423

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 09:14:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Wed, 24 Apr 2019 21:42:22 GMT
Server: Web Server
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Cache-Control: no-cache, max-age=15552000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 271582
X-XSS-Protection: 1; mode=block, 1; mode=block

GET
H2 200 combo
ceomedia.wf.com/wria/ 259 KB
36 KB 360ms
359ms Stylesheet
text/css 2a02:26f0:6c00:19d::1fa8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://ceomedia.wf.com/wria/combo?basePath=2.16.2/build&widget-base1Awidget-base.css&wf2-css-state/wf2-css-state-min.css&wf2-base-css1Awf2-base-css.css&wf2-css-tooltip/wf2-css-tooltip-min.css&wf2-css-button/wf2-css-button-min.css&widget-stack1Awidget-stack.css&wf2-balloon1Awf2-balloon.css&wf2-tooltip1Awf2-tooltip.css&wf2-button1Awf2-button.css&1HK1A1HK.css&wt2-icons1Awt2-icons.css&1HQ1A1HQ.css&wf2-treeview1Awf2-treeview.css&wf2-simplemenu1Awf2-simplemenu.css&wf2-menu-button1Awf2-menu-button.css&widget-modality1Awidget-modality.css&panel1Apanel.css&wf2-panel1Awf2-panel.css&wf2-icon-actionrequired1Awf2-icon-actionrequired.css&wf2-icon-verification1Awf2-icon-verification.css&wf2-icon-error1Awf2-icon-error.css&wf2-icon-informational1Awf2-icon-informational.css&wf2-icon-confirmation1Awf2-icon-confirmation.css&wf2-icon-warning1Awf2-icon-warning.css&wf2-messagebox1Awf2-messagebox.css&1DI1A1DI.css&wf2-css-utilities/wf2-css-utilities-min.css&1IA1A1IA.css&wf2-css-layout/wf2-css-layout-min.css&1BI1A1BI.css&wf2-css-display/wf2-css-display-min.css&wf2-icon-close1Awf2-icon-close.css&wf2-form-field-file1Awf2-form-field-file.css&wf2-flexgrid-core/wf2-flexgrid-core-min.css&wf2-feedback1Awf2-feedback.css&wf2-waitmessage1Awf2-waitmessage.css&wf2-icon-confirmation21Awf2-icon-confirmation2.css

Requested by

Host: ceomedia.wf.com
URL: https://ceomedia.wf.com/wria/2.16.2/build/wf2/wf2-min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:19d::1fa8 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Web Server /

Resource Hash

1254c4afbbef2270c9bda8cd32e26fd844ea440b99c1244d61f856dd35b06721

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
vary: Accept-Encoding
last-modified: Thu, 24 Jan 2019 22:54:13 GMT
server: Web Server
date: Wed, 26 Jun 2019 09:14:08 GMT
x-frame-options: SAMEORIGIN
content-type: text/css;charset=utf-8
status: 200
cache-control: max-age=31349908
content-length: 36318
x-xss-protection: 1; mode=block, 1; mode=block
expires: Tue, 23 Jun 2020 05:32:36 GMT

GET
H2 200 wca-min.js Show response
ceomedia.wf.com/wifp/js/ 750 B
713 B 360ms
358ms Script
application/javascript 2a02:26f0:6c00:19d::1fa8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://ceomedia.wf.com/wifp/js/wca-min.js

Requested by

Host: ceomedia.wf.com
URL: https://ceomedia.wf.com/wria/2.16.2/build/wf2/wf2-min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:19d::1fa8 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Web Server /

Resource Hash

431623637c01f4682858878437eb4be871a42f87aba6b676b6b246e13a6aed0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Wed, 19 Jun 2019 19:34:59 GMT
server: Web Server
x-frame-options: SAMEORIGIN
etag: "2ee-58bb253261ec0-gzip"
vary: Accept-Encoding
content-type: application/javascript
status: 200
date: Wed, 26 Jun 2019 09:14:08 GMT
accept-ranges: bytes
content-length: 445
x-xss-protection: 1; mode=block, 1; mode=block

GET
H2 200 dpwca-min.js Show response
ceomedia.wf.com/wifp/js/ 3 KB
2 KB 43ms
43ms Script
application/javascript 2a02:26f0:6c00:19d::1fa8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://ceomedia.wf.com/wifp/js/dpwca-min.js?ts=20196269

Requested by

Host: ceomedia.wf.com
URL: https://ceomedia.wf.com/wifp/js/wca-min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:19d::1fa8 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Web Server /

Resource Hash

138fcb158066977b611094b1656374a4b96fea1aef2364f495dd17e9686b5106

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Sat, 16 Mar 2019 07:42:41 GMT
server: Web Server
x-frame-options: SAMEORIGIN
etag: "c9c-584314ce4a516-gzip"
vary: Accept-Encoding
content-type: application/javascript
status: 200
date: Wed, 26 Jun 2019 09:14:08 GMT
accept-ranges: bytes
content-length: 1410
x-xss-protection: 1; mode=block, 1; mode=block

GET
H2 200 combo Show response
ceomedia.wf.com/wria/ 438 KB
106 KB 43ms
42ms Script
application/javascript 2a02:26f0:6c00:19d::1fa8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://ceomedia.wf.com/wria/combo?basePath=2.16.2/build&1AN/1AN1D&1AS/1AS1D&1ON/1ON1D&1CE/1CE1D&intl/intl1D&1WR/lang/1WR.js&1WR/1WR1D&1CH/lang/1CH.js&1HP/1HP1D&1L/1L1D&1KG/1KG1D&1RE/1RE1D&1RC/1RC1D&1EC/1EC1D&1LR/1LR1D&1UN/1UN1D&1UM/1UM1D&1CA/1CA1D&1VN/1VN1D&1OU/1OU1D&1GP/1GP1D&1WAs/lang/1WAs.js&1WAs/1WAs1D&1BD/1BD1D&1DA/1DA1D&1BC/1BC1D&1CR/1CR1D&1AR/1AR1D&1RA/1RA1D&1GW/1GW1D&1GW-native/1GW-native1D&1GW-null/1GW-null1D&1PX/1PX1D&wf2-1RK-scrollIntent/wf2-1RK-scrollIntent1D&1E/1E1D&1IK/1IK1D&1ER/1ER1D&1BX/1BX1D&1CF/1CF1D&1KF/1KF1D&1HK/1HK1D&1BWs/1BWs1D&1J/1J1D&1I/1I1D&1MD/1MD1D&1JL/1JL1D&tree/tree1D&1KL/1KL1D&1LI/1LI1D&1IL/1IL1D&view/view1D&1HQ/1HQ1D&1VU/1VU1D&1UV/1UV1D&1VQ/1VQ1D&1VT/1VT1D&1TV/1TV1D&1VS/1VS1D&1SV/1SV1D&1AM/1AM1D&1ML/1ML1D&1LM/1LM1D&1FB/1FB1D&1CO/1CO1D&1AG/1AG1D&1RW/1RW1D&1BW-down-triangle/1BW-down-triangle1D&1DH/1DH1D&1BE/1BE1D&1FA/1FA1D&1CD/1CD1D&1AD/1AD1D&1OE/1OE1D&1DR/1DR1D&1BW-close/1BW-close1D&1RB/1RB1D&1VK/1VK1D&1GQ/1GQ1D&1LO/1LO1D&1HB/1HB1D&1WA-actionrequired/1WA-actionrequired1D&1WA-verification/1WA-verification1D&1WA-error/1WA-error1D&1WA-informational/1WA-informational1D&1WA-confirmation/1WA-confirmation1D&1WA-warning/1WA-warning1D&1CH/1CH1D&1QP/1QP1D&1DI/lang/1DI.js&1MA/1MA1D&1NM/1NM1D&1P/1P1D&1DI/1DI1D&1IA/lang/1IA.js&1IA/1IA1D&1BI/lang/1BI.js&1BW-subaccount/1BW-subaccount1D&1BW-arrow-close/1BW-arrow-close1D&1BI/1BI1D&w1WU/w1WU1D&1IB/1IB1D&1ID-field-file/lang/1ID-field-file.js&1WA-close/1WA-close1D&1ID-field-file/1ID-field-file1D&1BQ/1BQ1D&1QA/1QA1D&1BW-confirmation/1BW-confirmation1D&1BW-error/1BW-error1D

Requested by

Host: ceomedia.wf.com
URL: https://ceomedia.wf.com/wria/2.16.2/build/wf2/wf2-min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:19d::1fa8 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Web Server /

Resource Hash

c33eba7e87a04dc725f59f1d441372a6f0734ca6aa78ae32246cb8d36832d248

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
vary: Accept-Encoding
last-modified: Fri, 25 Jan 2019 22:20:43 GMT
server: Web Server
date: Wed, 26 Jun 2019 09:14:08 GMT
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
status: 200
cache-control: max-age=31351164
content-length: 107733
x-xss-protection: 1; mode=block, 1; mode=block
expires: Tue, 23 Jun 2020 05:53:32 GMT

GET
H2 200 combo Show response
ceomedia.wf.com/wria/ 56 KB
17 KB 43ms
43ms Script
application/javascript 2a02:26f0:6c00:19d::1fa8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://ceomedia.wf.com/wria/combo?basePath=2.16.2/build&1BW-informational/1BW-informational1D&1BW-warning/1BW-warning1D&1R/1R1D&1IF/1IF1D&1KN/1KN1D&1KP/1KP1D&1NL/1NL1D&wt2-xdr/wt2-xdr1D&wf2-xdr/wf2-xdr1D&wf2-1PH/wf2-1PH1D&1BP/1BP1D&1HM/1HM1D&1KS/1KS1D&1SK/1SK1D&wt2-css-1OU/wt2-css-1OU1D&wt2-waitmessage/wt2-waitmessage1D&1BF/1BF1D&1WA-confirmation2/1WA-confirmation21D&1BW-confirmation2/1BW-confirmation21D

Requested by

Host: ceomedia.wf.com
URL: https://ceomedia.wf.com/wria/2.16.2/build/wf2/wf2-min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:19d::1fa8 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Web Server /

Resource Hash

83da81c1a0af2af6c898676f1a9111ca894ff01e4f51a2fc03f47bf53dcc672a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
vary: Accept-Encoding
last-modified: Wed, 30 Jan 2019 22:20:57 GMT
server: Web Server
date: Wed, 26 Jun 2019 09:14:08 GMT
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
status: 200
cache-control: max-age=31348147
content-length: 16770
x-xss-protection: 1; mode=block, 1; mode=block
expires: Tue, 23 Jun 2020 05:03:15 GMT

GET
H/1.1 200
OK cc.js Show response
wifp.wellsfargo.com/collector/ 28 KB
29 KB 919ms
189ms Script
application/javascript 159.45.161.35
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://wifp.wellsfargo.com/collector/cc.js?sid=0a2e0322d2965538f092b389ef5858efe16e7570f1f5d491bd9e8cb9d1786c1d&ts=1561540448427

Requested by

Host: ceomedia.wf.com
URL: https://ceomedia.wf.com/wifp/js/dpwca-min.js?ts=20196269

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_GCM

Server

159.45.161.35 , United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

Web Server /

Resource Hash

5397f12fe34832895a07da29c08fb6a1500af43104899cff262e1f0de096dc54

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.ctslink.com/a/welcome.html?TYPE=33554433&REALMOID=06-0001db9f-d296-135e-8965-8cd9a78f208d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-Db%2fvc0Xx734awGbRKmGU%2bQb3SK9fWKLKX4NTr9y%2flkRvrTEL8beQ6RcE7xqMBzd6WjlUKgq5o%2fclYBuHa2aH%2bkrZshVo%2bp7alYJ%2f5zvG6AzGo9LpodnCJyFiz8uwEwjG&TARGET=-SM-https%3a%2f%2fwww%2ectslink%2ecom%2f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 26 Jun 2019 09:14:09 GMT
Server: Web Server
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: application/javascript
Cache-Control: private, no-cache, proxy-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=15, max=100
Content-Length: 29021

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

355 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	script-src 'self' https://.wellsfargo.com https://.wf.com https://.accesswca.com https://.ctslink.com https://*.servicerconnect.com; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ceomedia.wf.com
wifp.wellsfargo.com
www.accesswca.com
www.ctslink.com
www.wellsfargo.com
www01.wellsfargomedia.com
104.109.70.200
159.45.161.35
159.45.6.12
159.45.6.40
159.45.66.145
2a02:26f0:6c00:19d::1fa8
02c11b20c746522d3b39463818eb1b102a24a049cde32e700d02ebe1bce8b6fc
04e3335bd8c3169c969d3eee07c46471537f461af3efc1c8a540a31411b0a4aa
1254c4afbbef2270c9bda8cd32e26fd844ea440b99c1244d61f856dd35b06721
136517b00afcfc85af33eaa62312e3900afcd3c220501b086a31911d08e49d53
138fcb158066977b611094b1656374a4b96fea1aef2364f495dd17e9686b5106
15f93d64144d386c80082dd9f918e1f57878e15298954c250a463bb2e29a524b
1bac50587be7dd42d1251e834dfd4a3514a883fa180af62dff73efee960fc832
26d2ed2b7dd5c16e22a418fc234b93bfe21f9d5a5bbcdacdfaa89bf8313fd107
2b7a594b7fe0ca8c16d0a9a54ac16db317d3ff63166f9133bfa712790bd12cb0
2dd1e20a794a7f761994974be8655c36ea5685259444c30d26d887a5457e7c52
3b1a5a6628a59442e97f24b29aa5d5fa8ea5833340782bb1887aac1ec6a5d962
3fe8062f4a3efc16c2be0c7819078d53cc831d81166493171ecf25dbd472c3d2
431623637c01f4682858878437eb4be871a42f87aba6b676b6b246e13a6aed0d
4d1f1db854995e6c2f366a876e5fb4b487df3ca357b84ddfa4f9d6451994ca90
5397f12fe34832895a07da29c08fb6a1500af43104899cff262e1f0de096dc54
58e352b1564d9adc16ec41e8f0be32cc22ad383c8139dbad53398212c9db69af
651340e9240afadeb01bbdc9b15e239059e12d3275bfbf6466d0675efbdbac76
71cc0bab512c09c1de31233e2694ed81aef7a39c84abeba6af8e7d501bad2eb6
75ee5d40befff7f45c0055222febcbe26fe73aed23a8b576886e6d5da60c90d6
7aa6da661575add37ac3b7f5aac259a35b60560887f4380378ee2e0d19515cf2
7f631964cc3f9e43b5d015f393c668499e1beb769b82e6ee9fd1e02149bf7423
8071d2e9ee7ab2fbbbd8925d2d7fa329ef353374cbbb205ee05a98576fdee4eb
83da81c1a0af2af6c898676f1a9111ca894ff01e4f51a2fc03f47bf53dcc672a
920492a843d91c4987dae43d2315bd5ddc00fb43d430f05c0b906ac8f65a0555
95ce78e538c31052ace9c3c0047a4b05a78bf55c4f34436928bfe67c08f03d20
b1c26d407e1ca174bf356cf7ffa935ce2441c129c2105d7ef12a28090a0eefbf
bdce3f64d3247c9100093b38bcb19d3eee6be03e9f9a6351009f7fc5065694ca
be1fbf9e9d377ed53864ec58dde302b1dc16a7d3170395e731e7b6cdc1193a8a
c33eba7e87a04dc725f59f1d441372a6f0734ca6aa78ae32246cb8d36832d248
cde3c7723f8f101df28d59fc04cd49966eba933bc7ff600ad0fb1bda9dcec454
da38fd7d6d2e1425dc8fecba13e64cd220d4f34d7c7d3ae76f9916d3b489b5d2
e20b059c7051277dbb18d5ece18584c70670bc8afd3639cecf2587b391bd6bb5
e27ee0dcbf3e8177889b2b11b651ffd5dda1994d88f1de01ee014d10e3ae63b1
eb85f7de4cd962979a9dd759e076b53d513c447bf2840a1e8fc59d9716327473
edc5ee3b590dae17b0eb19063c34680c15ee144d13583d006e6a7976b69cd2db
fca73d32371667fb593a78fe91d3906a3dde9e7032e8b57b975de78779f75818

www.ctslink.com Open in urlscan Pro 159.45.6.40 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

36 Requests

100 %HTTPS

17 %IPv6

5 Domains

6 Subdomains

6 IPs

3 Countries

2023 kBTransfer

2783 kBSize

0 Cookies

5 Outgoing links

Page URL History

Redirected requests

36 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.ctslink.com Open in urlscan Pro
159.45.6.40 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

36
Requests

100 %
HTTPS

17 %
IPv6

5
Domains

6
Subdomains

6
IPs

3
Countries

2023 kB
Transfer

2783 kB
Size

0
Cookies

36 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!