www.bancfirst.bank Open in urlscan Pro
24.248.243.7 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://bancfirst.com/
Effective URL:
https://www.bancfirst.bank/
Submission: On May 08 via manual (May 8th 2023, 12:48:48 pm UTC) from IL — Scanned from DE

Summary HTTP 38 Redirects Links 26 Behaviour Indicators

Summary

This website contacted 11 IPs in 3 countries across 9 domains to perform 38 HTTP transactions. The main IP is 24.248.243.7, located in Oklahoma City, United States and belongs to ASN-CXA-ALL-CCI-22773-RDC, US. The main domain is www.bancfirst.bank. The Cisco Umbrella rank of the primary domain is 804552.
TLS certificate: Issued by GeoTrust TLS RSA CA G1 on July 1st 2022. Valid for: a year.

This is the only time www.bancfirst.bank was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	24.248.243.8 24.248.243.8	36860 (BANCFIRST) (BANCFIRST)
25	24.248.243.7 24.248.243.7	22773 (ASN-CXA-A...) (ASN-CXA-ALL-CCI-22773-RDC)
1	2a00:1450:400... 2a00:1450:4001:803::200a	15169 (GOOGLE) (GOOGLE)
1	13.32.99.22 13.32.99.22	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:802::2008	15169 (GOOGLE) (GOOGLE)
1	2600:9000:206... 2600:9000:206f:3e00:c:abe:f440:93a1	16509 (AMAZON-02) (AMAZON-02)
1	52.28.99.188 52.28.99.188	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:82b::200e	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0d::9a	15169 (GOOGLE) (GOOGLE)
38	11

1 24.248.243.8 (Oklahoma City, United States) 1 redirects

ASN36860 (BANCFIRST, US)
PTR: www.bancfirst.com

bancfirst.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 24.248.243.7 (Oklahoma City, United States)

ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US)
PTR: www.bancfirst.bank

www.bancfirst.bank	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.99.22 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-22.fra60.r.cloudfront.net

platform-api.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:802::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206f:3e00:c:abe:f440:93a1 (United States)

ASN16509 (AMAZON-02, US)

buttons-config.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.28.99.188 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-99-188.eu-central-1.compute.amazonaws.com

l.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0d::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
25	bancfirst.bank www.bancfirst.bank — Cisco Umbrella Rank: 804552	4 MB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 30 region1.google-analytics.com — Cisco Umbrella Rank: 2587	21 KB
3	sharethis.com platform-api.sharethis.com — Cisco Umbrella Rank: 4402 buttons-config.sharethis.com — Cisco Umbrella Rank: 5305 l.sharethis.com — Cisco Umbrella Rank: 4488	47 KB
2	gstatic.com fonts.gstatic.com	53 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 48	158 KB
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 74	348 B
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 37	1 KB
1	bancfirst.com 1 redirects bancfirst.com	247 B
0	monsido.com Failed app-script.monsido.com Failed
38	9

	Domain	Requested by
25	www.bancfirst.bank	www.bancfirst.bank
2	fonts.gstatic.com	fonts.googleapis.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	www.googletagmanager.com	www.bancfirst.bank www.googletagmanager.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	region1.google-analytics.com	www.googletagmanager.com
1	l.sharethis.com	platform-api.sharethis.com
1	buttons-config.sharethis.com	platform-api.sharethis.com
1	platform-api.sharethis.com	www.bancfirst.bank
1	fonts.googleapis.com	www.bancfirst.bank
1	bancfirst.com	1 redirects
0	app-script.monsido.com Failed	www.googletagmanager.com
38	12

This site contains links to these domains. Also see Links.

Domain
www.bancfirst.insurance
clientpoint.fisglobal.com
bancfirst-trust.wealthaccess.com
bancfirst.tv
edie.fdic.gov
www.originatewebcenter.com
creditcardlearnmore.com
mortgageapp.bancfirst.bank
www.ordermychecks.com
workforcenow.adp.com
www.bancfirstonline.com
www.forbes.com
www.bancfirst.tv
www.facebook.com
www.instagram.com
www.linkedin.com
www.youtube.com
zaginteractive.com
www.fdic.gov
play.google.com
apps.apple.com

Subject Issuer	Validity	Valid
*.bancfirst.bank GeoTrust TLS RSA CA G1	`2022-07-01` - `2023-08-01`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-04-17` - `2023-07-10`	3 months	crt.sh
sharethis.com Amazon RSA 2048 M01	`2023-02-28` - `2023-07-18`	5 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-04-17` - `2023-07-10`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-04-17` - `2023-07-10`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-04-17` - `2023-07-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.bancfirst.bank/
Frame ID: EA9F17965BC3C346EE4A4E68A1447D44
Requests: 39 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BancFirst | Bank in Oklahoma | Accounts | Loans | BancFirst

Page URL History Show full URLs

http://bancfirst.com/ HTTP 301
https://www.bancfirst.bank/ Page URL

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

38
Requests

97 %
HTTPS

64 %
IPv6

9
Domains

12
Subdomains

11
IPs

3
Countries

4838 kB
Transfer

6259 kB
Size

5
Cookies

26 Outgoing links

These are links going to different origins than the main page.

URL: https://www.bancfirst.insurance/personal
Title: Personal Insurance

Search URL Search Domain Scan URL

URL: https://www.bancfirst.insurance/commercial
Title: Business Insurance

Search URL Search Domain Scan URL

URL: https://www.bancfirst.insurance/employee-benefits
Title: Employee Benefits

Search URL Search Domain Scan URL

URL: https://clientpoint.fisglobal.com/tdcb/main/UserLogon?bankNumber=RM&subProduct=
Title: Trust Client Point

Search URL Search Domain Scan URL

URL: https://bancfirst-trust.wealthaccess.com/Account/Login
Title: Trust Wealth Access

Search URL Search Domain Scan URL

URL: https://bancfirst.tv/first-things/
Title: Things to Know

Search URL Search Domain Scan URL

URL: https://edie.fdic.gov/index.html
Title: FDIC Deposit Insurance Estimator

Search URL Search Domain Scan URL

URL: https://www.originatewebcenter.com/uopen/originate/welcome.do?auth=143ace610eb356cc
Title: Apply for a Consumer Loan

Search URL Search Domain Scan URL

URL: https://creditcardlearnmore.com/11t3/index?ecdma-lc=20688&OTHE_25940
Title: Apply for a Credit Card

Search URL Search Domain Scan URL

URL: https://mortgageapp.bancfirst.bank/
Title: Start a Home Loan Request

Search URL Search Domain Scan URL

URL: https://www.ordermychecks.com/login_a.jsp
Title: Reorder Checks

Search URL Search Domain Scan URL

URL: https://workforcenow.adp.com/mascsr/default/mdf/recruitment/recruitment.html?cid=1da3e70c-e60a-466c-a367-419990b1b80f&ccId=19000101_000001&type=MP&lang=en_US
Title: Careers

Search URL Search Domain Scan URL

URL: https://mortgageapp.bancfirst.bank/pages/start-your-bancfirst-mortgage-application
Title: Apply for a Mortgage

Search URL Search Domain Scan URL

URL: https://www.bancfirstonline.com/tob/live/usp-core/app/register
Title: Enroll

Search URL Search Domain Scan URL

URL: https://www.bancfirstonline.com/tob/live/usp-core/app/authUpdate
Title: Forgot Username/Password

Search URL Search Domain Scan URL

URL: https://www.forbes.com/lists/worlds-best-banks/?sh=56c8373c7ef6
Title: Learn More

Search URL Search Domain Scan URL

URL: https://www.bancfirst.tv/
Title: The Best Oklahoma Stories

Search URL Search Domain Scan URL

URL: https://www.facebook.com/bancfirstok/
Title: Connect with us on Facebook

Search URL Search Domain Scan URL

URL: https://www.instagram.com/bancfirstok
Title: Connect with us on Instagram

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/bancfirst/mycompany
Title: Connect with us on LinkedIn

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/BancFirstOklahoma
Title: Connect with us on YouTube

Search URL Search Domain Scan URL

URL: https://workforcenow.adp.com/jobs/apply/posting.html?client=bancfirst&ccId=19000101_000001&type=MP&lang=en_US
Title: Careers

Search URL Search Domain Scan URL

URL: https://zaginteractive.com/
Title: ZAG Interactive

Search URL Search Domain Scan URL

URL: https://www.fdic.gov/resources/deposit-insurance/faq/

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.ifs.banking.fiid5362&hl=en_US&gl=US

Search URL Search Domain Scan URL

URL: https://apps.apple.com/us/app/bancfirst-mobile/id489601445

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bancfirst.com/ HTTP 301
https://www.bancfirst.bank/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

38 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.bancfirst.bank/
Redirect Chain

http://bancfirst.com/
https://www.bancfirst.bank/

103 KB
22 KB

1950ms
1320ms

Document
text/html

24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

a8715c1ef8138a8b9b41e71d16b64a96e5870fec3f63bcf12330dc642b9017cc

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
content-type: text/html; charset=utf-8
date: Mon, 08 May 2023 12:48:39 GMT
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
via: None
x-content-type-options: nosniff
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
x-frame-options: SAMEORIGIN
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

Connection: Keep-Alive
Content-Length: 234
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 08 May 2023 12:48:38 GMT
Keep-Alive: timeout=5, max=250
Location: https://www.bancfirst.bank
Server: Apache

GET
H2 200 css2
fonts.googleapis.com/ 8 KB
1 KB 141ms
52ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,500;0,700;1,500;1,700&family=Satisfy&display=swap

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d06e7baecd171c5f3159a4427949b11f092100a4f19b95d91c29e29e8ec1e63a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 08 May 2023 12:48:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 08 May 2023 12:48:41 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 08 May 2023 12:48:41 GMT

GET
H2 200 sharethis.js Show response
platform-api.sharethis.com/js/ 201 KB
45 KB 145ms
45ms Script
text/javascript 13.32.99.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://platform-api.sharethis.com/js/sharethis.js

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.99.22 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-99-22.fra60.r.cloudfront.net

Software

Resource Hash

47d522563a9f514094ee94ebcee33b1ab88ba91d5639393beecd18be1fd27c15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Mon, 08 May 2023 12:42:48 GMT
content-encoding: gzip
via: 1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P3
age: 353
etag: W/"32234-AoJ3k+MJOOKcahR2z6uk+gkFH+s"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
edge-control: cache-maxage=60m,downstream-ttl=60m
cache-control: max-age=600, public
x-cache: Hit from cloudfront
x-amz-cf-id: svXSvmjGPrbbxYrakUdRpjXCfSj3IRtTDYX2XOzk23CQY9O91jAG3w==

GET
H2 200 systemPageComponents.min.css
www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Content/Bundles/Public/ 8 KB
2 KB 167ms
167ms Stylesheet
text/css 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Content/Bundles/Public/systemPageComponents.min.css

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

94770d87b50fde93195e509ed623e41f00da035ab7a08b2399c3cf219e95a1c4

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
via: None
date: Mon, 08 May 2023 12:48:41 GMT
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 05 Oct 2022 12:15:32 GMT
server: Apache
etag: "1d8d8b42a21d57d"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 base.css
www.bancfirst.bank/assets/ 435 KB
86 KB 168ms
167ms Stylesheet
text/css 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/assets/base.css?v=35

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

a34f9a58c540d773e7c14e45a6c23422e12641981954ec8bfb36b805780975ba

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
via: None
date: Mon, 08 May 2023 12:48:41 GMT
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 18 Oct 2022 14:58:24 GMT
server: Apache
etag: "1d8e3021217a492"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 logo.svg
www.bancfirst.bank/Content/Images/ 15 KB
15 KB 469ms
469ms Image
image/svg+xml 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/Content/Images/logo.svg

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

488844f5d5f2c946db78f9af197b845224d010ed45663145e862bb73a9c3fdb2

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 08 May 2023 12:48:41 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
content-length: 14994
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 18 Oct 2022 14:57:32 GMT
server: Apache
etag: "1d8e301f312ec92"
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 236 KB
74 KB 175ms
70ms Script
application/javascript 2a00:1450:4001:802::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PP7Q5WN

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c8daf44305f72b391b3d421237e5b2f07276329ad8bc69ea38d633fe52f4cdee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Mon, 08 May 2023 12:48:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75006
x-xss-protection: 0
last-modified: Mon, 08 May 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 08 May 2023 12:48:41 GMT

GET
H2 200 personal-debit-cards.jpg
www.bancfirst.bank/getmedia/8942a457-8225-4fc4-a413-8fe8521aa671/ 48 KB
48 KB 337ms
335ms Image
image/jpeg 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/getmedia/8942a457-8225-4fc4-a413-8fe8521aa671/personal-debit-cards.jpg?width=510&height=270&ext=.jpg

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

ebce57e734e59300db2643d9632e5db7a6b4793bda76f46bfcc685f2a80308fc

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 08 May 2023 12:48:41 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
content-disposition: inline; filename=personal-debit-cards.jpg
x-forwarded-proto: $scheme;
content-length: 48845
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 02 Dec 2020 21:01:48 GMT
server: Apache
etag: "637425181089245118"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
expires: Mon, 08 May 2023 12:48:39 GMT

GET
H2 200 business-debit-cards.jpg
www.bancfirst.bank/getmedia/33d54a37-6a2b-4db3-aa1e-a5909c4ca247/ 32 KB
32 KB 335ms
332ms Image
image/jpeg 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/getmedia/33d54a37-6a2b-4db3-aa1e-a5909c4ca247/business-debit-cards.jpg?width=510&height=270&ext=.jpg

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

a9a3f85b17678ff637c166a3b65d4d0658005bf81e4439808018c202213832e0

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 08 May 2023 12:48:41 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
content-disposition: inline; filename=business-debit-cards.jpg
x-forwarded-proto: $scheme;
content-length: 32430
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 02 Dec 2020 21:01:48 GMT
server: Apache
etag: "637425181083254963"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
expires: Mon, 08 May 2023 12:48:39 GMT

GET
H2 200 loyalty-checking.jpg
www.bancfirst.bank/getmedia/bc1e869a-88bc-4c1e-8c99-a9ac9502b06b/ 34 KB
35 KB 336ms
334ms Image
image/jpeg 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/getmedia/bc1e869a-88bc-4c1e-8c99-a9ac9502b06b/loyalty-checking.jpg?width=510&height=270&ext=.jpg

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

562a4261ce490cc7b569dc58915add9691fc3c64143e0c8283843f08a24ce8b6

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 08 May 2023 12:48:41 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
content-disposition: inline; filename=loyalty-checking.jpg
x-forwarded-proto: $scheme;
content-length: 35074
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 02 Dec 2020 21:01:48 GMT
server: Apache
etag: "637425181085325000"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
expires: Mon, 08 May 2023 12:48:39 GMT

GET
H2 200 hp-community.jpg
www.bancfirst.bank/getmedia/28b35b83-3922-4a08-b5bd-58a1784b878e/ 180 KB
181 KB 336ms
333ms Image
image/jpeg 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/getmedia/28b35b83-3922-4a08-b5bd-58a1784b878e/hp-community.jpg?width=360&height=444&ext=.jpg

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

3806ac8a290d9f6f3dbea7a41fd827fcf625e4ce935e042d31c933c7468df423

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 08 May 2023 12:48:41 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
content-disposition: inline; filename=hp-community.jpg
x-forwarded-proto: $scheme;
content-length: 184334
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 02 Dec 2020 21:02:22 GMT
server: Apache
etag: "637425181423474016"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
expires: Mon, 08 May 2023 12:48:39 GMT

GET
H2 200 ehl.png
www.bancfirst.bank/Content/Images/ 2 KB
2 KB 328ms
326ms Image
image/png 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/Content/Images/ehl.png

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

cf380d3d57c6f269c1228465721edd60db00e1fc3d1bd5568bdde8477f6ff59a

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 08 May 2023 12:48:41 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
content-length: 2187
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 18 Oct 2022 14:57:32 GMT
server: Apache
etag: "1d8e301f312de8b"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 fdic.png
www.bancfirst.bank/Content/Images/ 4 KB
4 KB 328ms
326ms Image
image/png 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/Content/Images/fdic.png

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

e36a1706accaa88e75385084678d454ccf887c139ec4de1b0c7474a7381776de

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 08 May 2023 12:48:41 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
content-length: 3876
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 18 Oct 2022 14:57:32 GMT
server: Apache
etag: "1d8e301f312d924"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 google-play.png
www.bancfirst.bank/Content/Images/ 6 KB
6 KB 327ms
326ms Image
image/png 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/Content/Images/google-play.png

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

4d33f0a233d3abb125e700b5b40dda14e5d72db6ffa7d01188d7b61bdec00d45

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 08 May 2023 12:48:41 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
content-length: 6021
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 18 Oct 2022 14:57:32 GMT
server: Apache
etag: "1d8e301f312c185"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 app-store.png
www.bancfirst.bank/Content/Images/ 3 KB
3 KB 328ms
327ms Image
image/png 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/Content/Images/app-store.png

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

fe1de787b0ac87b545636b9f969ecabef35734b74ca17b5484246c7442afad0b

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 08 May 2023 12:48:41 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
content-length: 3356
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 18 Oct 2022 14:57:32 GMT
server: Apache
etag: "1d8e301f312db1c"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 jquery-3.5.1.js Show response
www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Scripts/ 292 KB
113 KB 332ms
331ms Script
application/javascript 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Scripts/jquery-3.5.1.js

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

a28d76c983b06d87eb2c6d6deaff7e1d4faf32f12794a92bd5e21c754c06ed9b

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
via: None
date: Mon, 08 May 2023 12:48:41 GMT
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 05 Oct 2022 12:15:32 GMT
server: Apache
etag: "1d8d8b42a254406"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 jquery.unobtrusive-ajax.js Show response
www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Scripts/ 4 KB
2 KB 485ms
484ms Script
application/javascript 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Scripts/jquery.unobtrusive-ajax.js

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

755f82e7a0f8a0c0ea3ed5806e77b6e4eb0a5e4b96d739f09602b51274e75461

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
via: None
date: Mon, 08 May 2023 12:48:41 GMT
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 05 Oct 2022 12:15:32 GMT
server: Apache
etag: "1d8d8b42a21c446"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 systemFormComponents.min.js Show response
www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Content/Bundles/Public/ 58 KB
24 KB 486ms
485ms Script
application/javascript 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Content/Bundles/Public/systemFormComponents.min.js

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

78f94aee3ab9895d5707a499d1ad149d80f627ce7193975c228f95f1f23c1cd2

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
via: None
date: Mon, 08 May 2023 12:48:41 GMT
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 05 Oct 2022 12:15:32 GMT
server: Apache
etag: "1d8d8b42a212ccd"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 base.js Show response
www.bancfirst.bank/assets/ 435 KB
179 KB 486ms
485ms Script
application/javascript 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/assets/base.js?v=35

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

7c937d5dcd73c56220ad616213711b5771892ade6a890654567b861b5900a81e

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
via: None
date: Mon, 08 May 2023 12:48:41 GMT
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Mon, 12 Dec 2022 21:15:30 GMT
server: Apache
etag: "1d90e6edce989fe"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 Auto23.jpg
www.bancfirst.bank/getattachment/0b10cc4d-ecc8-4f98-a3bd-b0a0a696443f/ 1 MB
1 MB 460ms
459ms Image
image/jpeg 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/getattachment/0b10cc4d-ecc8-4f98-a3bd-b0a0a696443f/Auto23.jpg?lang=en-US&ext=.jpg

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

b83e3d22db656f1cf5412ba71e3d1b9c2a0bfce8dc840d3a40e1120c2d1e3bb7

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 08 May 2023 12:48:41 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
content-disposition: inline; filename=Auto23.jpg
x-forwarded-proto: $scheme;
content-length: 1306066
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Thu, 04 May 2023 12:19:34 GMT
server: Apache
etag: "en-us|0b10cc4d-ecc8-4f98-a3bd-b0a0a696443f|638187815743317469|true"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
expires: Mon, 08 May 2023 12:48:39 GMT

GET
H2 200 ForbesWorldsBest_HomepageBanner.jpg
www.bancfirst.bank/getmedia/7316c1f8-b0f8-42f6-8daf-c9444532fd06/ 912 KB
913 KB 600ms
599ms Image
image/jpeg 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/getmedia/7316c1f8-b0f8-42f6-8daf-c9444532fd06/ForbesWorldsBest_HomepageBanner.jpg?width=1575&height=750&ext=.jpg

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

e235b44ac7a5215ac6376b66d54df976632575cace54c35968b3d4afbcbb1165

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 08 May 2023 12:48:41 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
content-disposition: inline; filename=ForbesWorldsBest_HomepageBanner.jpg
x-forwarded-proto: $scheme;
content-length: 933733
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 14 Apr 2023 20:25:23 GMT
server: Apache
etag: "638170827235152809"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
expires: Mon, 08 May 2023 12:48:39 GMT

GET
H2 200 LoyaltyChecking_Best5Dollars.jpg
www.bancfirst.bank/getmedia/6790b1ef-f9e9-415d-b7d5-d5a91c67faeb/ 432 KB
434 KB 601ms
600ms Image
image/jpeg 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/getmedia/6790b1ef-f9e9-415d-b7d5-d5a91c67faeb/LoyaltyChecking_Best5Dollars.jpg?width=1575&height=750&ext=.jpg

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

30a180a7b0d21eb4062cfadc06b0309937db1b40a07633c0aab643b8f3b6c455

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 08 May 2023 12:48:41 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
content-disposition: inline; filename=LoyaltyChecking_Best5Dollars.jpg
x-forwarded-proto: $scheme;
content-length: 442549
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 27 Jan 2023 14:37:01 GMT
server: Apache
etag: "638104054215939069"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
expires: Mon, 08 May 2023 12:48:39 GMT

GET
H2 200 FraudPrevention-Business.jpg
www.bancfirst.bank/getmedia/45f5cf88-4477-42d4-99d1-67fe6ff5ad7e/ 447 KB
448 KB 601ms
600ms Image
image/jpeg 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/getmedia/45f5cf88-4477-42d4-99d1-67fe6ff5ad7e/FraudPrevention-Business.jpg?width=1575&height=750&ext=.jpg

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

b5fdcf96c8843ab785fb4eaf3e82561346ae8d41d86ce69f236c17019db65439

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 08 May 2023 12:48:41 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
content-disposition: inline; filename=FraudPrevention-Business.jpg
x-forwarded-proto: $scheme;
content-length: 457713
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 27 Jan 2023 14:37:42 GMT
server: Apache
etag: "638104054629450900"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
expires: Mon, 08 May 2023 12:48:39 GMT

GET
H2 200 5f8dcf1b3b070c0012e34660.js Show response
buttons-config.sharethis.com/js/ 475 B
920 B 530ms
425ms Script
text/javascript 2600:9000:206f:3e00:c:abe:f440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://buttons-config.sharethis.com/js/5f8dcf1b3b070c0012e34660.js

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:206f:3e00:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

9f9f9309a105891cafd375d6898e28f4f3b16fa11497d7d1cafa8e1102e624b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Mon, 08 May 2023 12:48:42 GMT
via: 1.1 cf2939e85531f45f3306f792ea104eaa.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Mon, 19 Oct 2020 19:54:14 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
etag: "8c4cfb530c79fe050eb48be8f77d6536"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: text/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 475
x-amz-cf-id: QytUoF9wrhS3sAojP_4XU_tHqkIVm0VRm7HhB11QlY-16iAPGSF-Pg==

GET
H/1.1 204
No Content pview Show response
l.sharethis.com/ 0
405 B 191ms
42ms XHR
text/plain 52.28.99.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://l.sharethis.com/pview?event=pview&hostname=www.bancfirst.bank&location=%2F&product=inline-share-buttons&url=https%3A%2F%2Fwww.bancfirst.bank%2F&source=sharethis.js&fcmp=false&fcmpv2=false&has_segmentio=false&title=BancFirst%20%7C%20Bank%20in%20Oklahoma%20%7C%20Accounts%20%7C%20Loans%20%7C%20BancFirst&cms=unknown&publisher=5f8dcf1b3b070c0012e34660&sop=true&version=st_sop.js&lang=en&ua=&ua_mobile=false&ua_full_version_list=

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.28.99.188 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-28-99-188.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Mon, 08 May 2023 12:48:41 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains;
Access-Control-Max-Age: 1728000
Access-Control-Allow-Origin: https://www.bancfirst.bank
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 51 KB
21 KB 132ms
40ms Script
text/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PP7Q5WN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 08 May 2023 11:05:00 GMT
last-modified: Mon, 17 Apr 2023 22:36:01 GMT
server: Golfe2
age: 6221
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20737
expires: Mon, 08 May 2023 13:05:00 GMT

GET monsido-script.js
app-script.monsido.com/v2/ 0
0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 258 KB
85 KB 60ms
60ms Script
application/javascript 2a00:1450:4001:802::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-3DBMD34SP1&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PP7Q5WN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

dc2476069541cc41aa48ef6195f6602ac0958a729d6fc7de68047a41de96a0c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Mon, 08 May 2023 12:48:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 86514
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 08 May 2023 12:48:41 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
256 B 139ms
51ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-3DBMD34SP1&gtm=45je3530&_p=968170620&cid=1581299605.1683550121&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EA&_s=1&sid=1683550121&sct=1&seg=0&dl=https%3A%2F%2Fwww.bancfirst.bank%2F&dt=BancFirst%20%7C%20Bank%20in%20Oklahoma%20%7C%20Accounts%20%7C%20Loans%20%7C%20BancFirst&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-3DBMD34SP1&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 08 May 2023 12:48:41 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bancfirst.bank
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
211 B 48ms
47ms XHR
text/plain 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j100&a=968170620&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bancfirst.bank%2F&ul=en-us&de=UTF-8&dt=BancFirst%20%7C%20Bank%20in%20Oklahoma%20%7C%20Accounts%20%7C%20Loans%20%7C%20BancFirst&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACEABBAAAACAAI~&jid=436260978&gjid=729207896&cid=1581299605.1683550121&tid=UA-61103203-1&_gid=349787204.1683550121&_r=1&_slc=1&gtm=45He3530n81PP7Q5WN&z=1113132625

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bancfirst.bank/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 08 May 2023 12:48:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bancfirst.bank
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v25/ 30 KB
31 KB 143ms
39ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,500;0,700;1,500;1,700&family=Satisfy&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.bancfirst.bank
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Sat, 06 May 2023 18:31:37 GMT
x-content-type-options: nosniff
age: 152224
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30928
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:57:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 05 May 2024 18:31:37 GMT

GET
DATA 200
OK truncated
/ 134 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 93ee19994358156fbbe3bcbb748f51b8d5bd6199ff589f8955eaacfa59d5cb2c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 bg-pattern.png
www.bancfirst.bank/Content/Images/ 159 KB
159 KB 486ms
486ms Image
image/png 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/Content/Images/bg-pattern.png

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/assets/base.css?v=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

136c3395c2daf6c35d35ede610cde15d479b8862212b87b3d06fea3e84927a71

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/assets/base.css?v=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 08 May 2023 12:48:41 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
content-length: 162843
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 18 Oct 2022 14:57:32 GMT
server: Apache
etag: "1d8e301f310aa1b"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 fa-brands-400.woff2
www.bancfirst.bank/fonts/fontawesome-pro/webfonts/ 76 KB
76 KB 481ms
479ms Font
font/woff2 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/fonts/fontawesome-pro/webfonts/fa-brands-400.woff2

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/assets/base.css?v=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

479a88b36a9e0fd38bdfd22e19701576cd6cb01f36a21ce9935ad6a2d746e620

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bancfirst.bank/assets/base.css?v=35
Origin: https://www.bancfirst.bank
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 08 May 2023 12:48:41 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
content-length: 77452
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sat, 26 Oct 1985 10:15:00 GMT
server: Apache
etag: "1af6dcadbc0448c"
x-frame-options: SAMEORIGIN
content-type: font/woff2
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 fa-regular-400.woff2
www.bancfirst.bank/fonts/fontawesome-pro/webfonts/ 170 KB
171 KB 482ms
481ms Font
font/woff2 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/fonts/fontawesome-pro/webfonts/fa-regular-400.woff2

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/assets/base.css?v=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

a12ccfbc48872b90c3396cc47266a717a995665bb8a23a7fe982ad04432b8679

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bancfirst.bank/assets/base.css?v=35
Origin: https://www.bancfirst.bank
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 08 May 2023 12:48:41 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
content-length: 174348
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sat, 26 Oct 1985 10:15:00 GMT
server: Apache
etag: "1af6dcadbc3c30c"
x-frame-options: SAMEORIGIN
content-type: font/woff2
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 fa-light-300.woff2
www.bancfirst.bank/fonts/fontawesome-pro/webfonts/ 186 KB
186 KB 482ms
481ms Font
font/woff2 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/fonts/fontawesome-pro/webfonts/fa-light-300.woff2

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/assets/base.css?v=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

69885c352b73c062750dd828a00cb617eea070cd1053590cedd947a7b5d5b152

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bancfirst.bank/assets/base.css?v=35
Origin: https://www.bancfirst.bank
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 08 May 2023 12:48:41 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
content-length: 190452
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sat, 26 Oct 1985 10:15:00 GMT
server: Apache
etag: "1af6dcadbc38df4"
x-frame-options: SAMEORIGIN
content-type: font/woff2
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 fa-solid-900.woff2
www.bancfirst.bank/fonts/fontawesome-pro/webfonts/ 138 KB
139 KB 483ms
482ms Font
font/woff2 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/fonts/fontawesome-pro/webfonts/fa-solid-900.woff2

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/assets/base.css?v=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Oklahoma City, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

1c4076badc540e6416c97b7202cfb69b7c9b4a5f9750cbf01a0bd3b0ad6fecc9

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bancfirst.bank/assets/base.css?v=35
Origin: https://www.bancfirst.bank
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 08 May 2023 12:48:41 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
content-length: 141672
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sat, 26 Oct 1985 10:15:00 GMT
server: Apache
etag: "1af6dcadbc34368"
x-frame-options: SAMEORIGIN
content-type: font/woff2
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 rP2Hp2yn6lkG50LoCZOIHQ.woff2
fonts.gstatic.com/s/satisfy/v17/ 22 KB
22 KB 177ms
83ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/satisfy/v17/rP2Hp2yn6lkG50LoCZOIHQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,500;0,700;1,500;1,700&family=Satisfy&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a02009d2f95d79b62b95c6de12d6614bdb36bffa6d4e756db81ec1c51c5acc34

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.bancfirst.bank
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Sat, 06 May 2023 00:17:53 GMT
x-content-type-options: nosniff
age: 217848
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22652
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:12:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 05 May 2024 00:17:53 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
348 B 174ms
49ms XHR
text/plain 2a00:1450:400c:c0d::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j100&tid=UA-61103203-1&cid=1581299605.1683550121&jid=436260978&gjid=729207896&_gid=349787204.1683550121&_u=YCDACEAABAAAACAAI~&z=1280580346

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0d::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bancfirst.bank/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 08 May 2023 12:48:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bancfirst.bank
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: app-script.monsido.com
URL: https://app-script.monsido.com/v2/monsido-script.js

Verdicts & Comments Add Verdict or Comment

33 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.bancfirst.bank/	1969-12-31 23:59:59	Name: .AspNetCore.Antiforgery.IbxhE25l3WQ Value: CfDJ8IifON3ADnNEjvAcDsTnbuqxW_RFiPcZV5jMgdCvWqg7nCnGKLVTISH0fq9NWLo3WU2g9GeIIBXQLx_K7yF45EO7Rd1ceQwWJOYEwthSLMuWmdfWa2e6d-wfaA-LChrZsxLfwkHRBMrDR3eoXWA0vRg
.bancfirst.bank/	1970-01-20 21:15:10	Name: _ga_3DBMD34SP1 Value: GS1.1.1683550121.1.0.1683550121.0.0.0
.bancfirst.bank/	1970-01-20 21:15:10	Name: _ga Value: GA1.2.1581299605.1683550121
.bancfirst.bank/	1970-01-20 11:40:36	Name: _gid Value: GA1.2.349787204.1683550121
.bancfirst.bank/	1970-01-20 11:39:10	Name: _gat_UA-61103203-1 Value: 1

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-PP7Q5WN(Line 442) Message: Refused to load the script 'https://app-script.monsido.com/v2/monsido-script.js' because it violates the following Content Security Policy directive: "script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app-script.monsido.com
bancfirst.com
buttons-config.sharethis.com
fonts.googleapis.com
fonts.gstatic.com
l.sharethis.com
platform-api.sharethis.com
region1.google-analytics.com
stats.g.doubleclick.net
www.bancfirst.bank
www.google-analytics.com
www.googletagmanager.com
app-script.monsido.com
13.32.99.22
2001:4860:4802:32::36
24.248.243.7
24.248.243.8
2600:9000:206f:3e00:c:abe:f440:93a1
2a00:1450:4001:802::2008
2a00:1450:4001:803::2003
2a00:1450:4001:803::200a
2a00:1450:4001:82b::200e
2a00:1450:400c:c0d::9a
52.28.99.188
136c3395c2daf6c35d35ede610cde15d479b8862212b87b3d06fea3e84927a71
1c4076badc540e6416c97b7202cfb69b7c9b4a5f9750cbf01a0bd3b0ad6fecc9
30a180a7b0d21eb4062cfadc06b0309937db1b40a07633c0aab643b8f3b6c455
3806ac8a290d9f6f3dbea7a41fd827fcf625e4ce935e042d31c933c7468df423
479a88b36a9e0fd38bdfd22e19701576cd6cb01f36a21ce9935ad6a2d746e620
47d522563a9f514094ee94ebcee33b1ab88ba91d5639393beecd18be1fd27c15
488844f5d5f2c946db78f9af197b845224d010ed45663145e862bb73a9c3fdb2
4d33f0a233d3abb125e700b5b40dda14e5d72db6ffa7d01188d7b61bdec00d45
562a4261ce490cc7b569dc58915add9691fc3c64143e0c8283843f08a24ce8b6
69885c352b73c062750dd828a00cb617eea070cd1053590cedd947a7b5d5b152
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
755f82e7a0f8a0c0ea3ed5806e77b6e4eb0a5e4b96d739f09602b51274e75461
78f94aee3ab9895d5707a499d1ad149d80f627ce7193975c228f95f1f23c1cd2
7c937d5dcd73c56220ad616213711b5771892ade6a890654567b861b5900a81e
93ee19994358156fbbe3bcbb748f51b8d5bd6199ff589f8955eaacfa59d5cb2c
94770d87b50fde93195e509ed623e41f00da035ab7a08b2399c3cf219e95a1c4
9f9f9309a105891cafd375d6898e28f4f3b16fa11497d7d1cafa8e1102e624b7
a02009d2f95d79b62b95c6de12d6614bdb36bffa6d4e756db81ec1c51c5acc34
a12ccfbc48872b90c3396cc47266a717a995665bb8a23a7fe982ad04432b8679
a28d76c983b06d87eb2c6d6deaff7e1d4faf32f12794a92bd5e21c754c06ed9b
a34f9a58c540d773e7c14e45a6c23422e12641981954ec8bfb36b805780975ba
a8715c1ef8138a8b9b41e71d16b64a96e5870fec3f63bcf12330dc642b9017cc
a9a3f85b17678ff637c166a3b65d4d0658005bf81e4439808018c202213832e0
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b5fdcf96c8843ab785fb4eaf3e82561346ae8d41d86ce69f236c17019db65439
b83e3d22db656f1cf5412ba71e3d1b9c2a0bfce8dc840d3a40e1120c2d1e3bb7
c8daf44305f72b391b3d421237e5b2f07276329ad8bc69ea38d633fe52f4cdee
cf380d3d57c6f269c1228465721edd60db00e1fc3d1bd5568bdde8477f6ff59a
d06e7baecd171c5f3159a4427949b11f092100a4f19b95d91c29e29e8ec1e63a
dc2476069541cc41aa48ef6195f6602ac0958a729d6fc7de68047a41de96a0c2
e235b44ac7a5215ac6376b66d54df976632575cace54c35968b3d4afbcbb1165
e36a1706accaa88e75385084678d454ccf887c139ec4de1b0c7474a7381776de
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
ebce57e734e59300db2643d9632e5db7a6b4793bda76f46bfcc685f2a80308fc
fe1de787b0ac87b545636b9f969ecabef35734b74ca17b5484246c7442afad0b

www.bancfirst.bank Open in urlscan Pro 24.248.243.7 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

38 Requests

97 %HTTPS

64 %IPv6

9 Domains

12 Subdomains

11 IPs

3 Countries

4838 kBTransfer

6259 kBSize

5 Cookies

26 Outgoing links

Page URL History

Redirected requests

38 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.bancfirst.bank Open in urlscan Pro
24.248.243.7 Public Scan

Screenshot
Live screenshot

Full Image

38
Requests

97 %
HTTPS

64 %
IPv6

9
Domains

12
Subdomains

11
IPs

3
Countries

4838 kB
Transfer

6259 kB
Size

5
Cookies

38 HTTP transactions
1 data transactions