www.bancfirst.bank Open in urlscan Pro
24.248.243.7 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://bancfirst.com/
Effective URL:
https://www.bancfirst.bank/
Submission: On February 01 via manual (February 1st 2023, 1:45:56 pm UTC) from US — Scanned from DE

Summary HTTP 37 Redirects Links 23 Behaviour Indicators

Summary

This website contacted 11 IPs in 4 countries across 8 domains to perform 37 HTTP transactions. The main IP is 24.248.243.7, located in Tulsa, United States and belongs to ASN-CXA-ALL-CCI-22773-RDC, US. The main domain is www.bancfirst.bank. The Cisco Umbrella rank of the primary domain is 817611.
TLS certificate: Issued by GeoTrust TLS RSA CA G1 on July 1st 2022. Valid for: a year.

This is the only time www.bancfirst.bank was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	24.248.243.8 24.248.243.8	36860 (BANCFIRST) (BANCFIRST)
25	24.248.243.7 24.248.243.7	22773 (ASN-CXA-A...) (ASN-CXA-ALL-CCI-22773-RDC)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
1	13.32.27.7 13.32.27.7	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:806::2008	15169 (GOOGLE) (GOOGLE)
1	2600:9000:206... 2600:9000:206f:0:c:abe:f440:93a1	16509 (AMAZON-02) (AMAZON-02)
1	3.120.54.96 3.120.54.96	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:400d:802::200e	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400d:80a::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0a::9a	15169 (GOOGLE) (GOOGLE)
37	11

1 24.248.243.8 (Tulsa, United States) 1 redirects

ASN36860 (BANCFIRST, US)
PTR: www.bancfirst.com

bancfirst.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 24.248.243.7 (Tulsa, United States)

ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US)
PTR: www.bancfirst.bank

www.bancfirst.bank	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.7 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-7.fra56.r.cloudfront.net

platform-api.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206f:0:c:abe:f440:93a1 (United States)

ASN16509 (AMAZON-02, US)

buttons-config.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.120.54.96 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-120-54-96.eu-central-1.compute.amazonaws.com

l.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400d:802::200e (Ireland)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400d:80a::2003 (Ireland)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0a::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
25	bancfirst.bank www.bancfirst.bank — Cisco Umbrella Rank: 817611	3 MB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 21 region1.google-analytics.com — Cisco Umbrella Rank: 2456	20 KB
3	sharethis.com platform-api.sharethis.com — Cisco Umbrella Rank: 4428 buttons-config.sharethis.com — Cisco Umbrella Rank: 5738 l.sharethis.com — Cisco Umbrella Rank: 4655	46 KB
2	gstatic.com fonts.gstatic.com	53 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 40	150 KB
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 78	348 B
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 34	1 KB
1	bancfirst.com 1 redirects bancfirst.com	247 B
37	8

	Domain	Requested by
25	www.bancfirst.bank	www.bancfirst.bank
2	fonts.gstatic.com	fonts.googleapis.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	www.googletagmanager.com	www.bancfirst.bank www.googletagmanager.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	region1.google-analytics.com	www.googletagmanager.com
1	l.sharethis.com	platform-api.sharethis.com
1	buttons-config.sharethis.com	platform-api.sharethis.com
1	platform-api.sharethis.com	www.bancfirst.bank
1	fonts.googleapis.com	www.bancfirst.bank
1	bancfirst.com	1 redirects
37	11

This site contains links to these domains. Also see Links.

Domain
www.bancfirst.insurance
clientpoint.fisglobal.com
bancfirst-trust.wealthaccess.com
bancfirst.tv
www.bancfirst.tv
umnasg7.umonitor.com
creditcardlearnmore.com
mortgageapp.bancfirst.bank
www.ordermychecks.com
workforcenow.adp.com
www.bancfirstonline.com
www.facebook.com
www.instagram.com
www.linkedin.com
www.youtube.com
zaginteractive.com
play.google.com
apps.apple.com

Subject Issuer	Validity	Valid
*.bancfirst.bank GeoTrust TLS RSA CA G1	`2022-07-01` - `2023-08-01`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
sharethis.com Amazon	`2022-06-19` - `2023-07-18`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.bancfirst.bank/
Frame ID: 5B380D1BCA82252F1D05C5BDADC206C0
Requests: 38 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BancFirst | Bank in Oklahoma | Accounts | Loans | BancFirst

Page URL History Show full URLs

http://bancfirst.com/ HTTP 301
https://www.bancfirst.bank/ Page URL

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

37
Requests

100 %
HTTPS

64 %
IPv6

8
Domains

11
Subdomains

11
IPs

4
Countries

3256 kB
Transfer

4652 kB
Size

5
Cookies

23 Outgoing links

These are links going to different origins than the main page.

URL: https://www.bancfirst.insurance/personal
Title: Personal Insurance

Search URL Search Domain Scan URL

URL: https://www.bancfirst.insurance/commercial
Title: Business Insurance

Search URL Search Domain Scan URL

URL: https://www.bancfirst.insurance/employee-benefits
Title: Employee Benefits

Search URL Search Domain Scan URL

URL: https://clientpoint.fisglobal.com/tdcb/main/UserLogon?bankNumber=RM&subProduct=
Title: Trust Client Point

Search URL Search Domain Scan URL

URL: https://bancfirst-trust.wealthaccess.com/Account/Login
Title: Trust Wealth Access

Search URL Search Domain Scan URL

URL: https://bancfirst.tv/first-things/
Title: Things to Know

Search URL Search Domain Scan URL

URL: https://www.bancfirst.tv/
Title: BancFirst TV

Search URL Search Domain Scan URL

URL: https://umnasg7.umonitor.com/consumerloan/uLoan/welcome.do?auth=eb49a03c3e5dcb39
Title: Apply for a Consumer Loan

Search URL Search Domain Scan URL

URL: https://creditcardlearnmore.com/11t3/index?ecdma-lc=20688&OTHE_25940
Title: Apply for a Credit Card

Search URL Search Domain Scan URL

URL: https://mortgageapp.bancfirst.bank/
Title: Start a Home Loan Request

Search URL Search Domain Scan URL

URL: https://www.ordermychecks.com/login_a.jsp
Title: Reorder Checks

Search URL Search Domain Scan URL

URL: https://workforcenow.adp.com/mascsr/default/mdf/recruitment/recruitment.html?cid=1da3e70c-e60a-466c-a367-419990b1b80f&ccId=19000101_000001&type=MP&lang=en_US
Title: Careers

Search URL Search Domain Scan URL

URL: https://mortgageapp.bancfirst.bank/pages/start-your-bancfirst-mortgage-application
Title: Apply for a Mortgage

Search URL Search Domain Scan URL

URL: https://www.bancfirstonline.com/tob/live/usp-core/app/register
Title: Enroll

Search URL Search Domain Scan URL

URL: https://www.bancfirstonline.com/tob/live/usp-core/app/authUpdate
Title: Forgot Username/Password

Search URL Search Domain Scan URL

URL: https://www.facebook.com/bancfirstok/
Title: Connect with us on Facebook

Search URL Search Domain Scan URL

URL: https://www.instagram.com/bancfirstok
Title: Connect with us on Instagram

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/bancfirst/mycompany
Title: Connect with us on LinkedIn

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/BancFirstOklahoma
Title: Connect with us on YouTube

Search URL Search Domain Scan URL

URL: https://workforcenow.adp.com/jobs/apply/posting.html?client=bancfirst&ccId=19000101_000001&type=MP&lang=en_US
Title: Careers

Search URL Search Domain Scan URL

URL: https://zaginteractive.com/
Title: ZAG Interactive

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.ifs.banking.fiid5362&hl=en_US&gl=US

Search URL Search Domain Scan URL

URL: https://apps.apple.com/us/app/bancfirst-mobile/id489601445

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bancfirst.com/ HTTP 301
https://www.bancfirst.bank/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

37 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.bancfirst.bank/
Redirect Chain

http://bancfirst.com/
https://www.bancfirst.bank/

102 KB
22 KB

3340ms
2717ms

Document
text/html

24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

10d999f5bdecf7545e61e31f54c84f5938d5c0ed97e13d2f89e109282d1103c3

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
content-type: text/html; charset=utf-8
date: Wed, 01 Feb 2023 13:45:47 GMT
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
via: None
x-content-type-options: nosniff
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
x-frame-options: SAMEORIGIN
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

Connection: Keep-Alive
Content-Length: 234
Content-Type: text/html; charset=iso-8859-1
Date: Wed, 01 Feb 2023 13:45:46 GMT
Keep-Alive: timeout=5, max=250
Location: https://www.bancfirst.bank
Server: Apache

GET
H2 200 css2
fonts.googleapis.com/ 7 KB
1 KB 141ms
50ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,500;0,700;1,500;1,700&family=Satisfy&display=swap

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b944452f6df07e2e141bead92186e220d9f27b185643192d345c02004f69be7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 01 Feb 2023 13:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 01 Feb 2023 13:45:50 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 01 Feb 2023 13:45:50 GMT

GET
H2 200 sharethis.js Show response
platform-api.sharethis.com/js/ 197 KB
44 KB 140ms
45ms Script
text/javascript 13.32.27.7
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://platform-api.sharethis.com/js/sharethis.js

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.7 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-27-7.fra56.r.cloudfront.net

Software

Resource Hash

4c762350bf5dcf159a3adfddb1c33d90a8d85daaf7c5de9ea82b5fd201dd2d5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Wed, 01 Feb 2023 13:38:57 GMT
content-encoding: gzip
via: 1.1 3d58896f901dbeed449603f5d2b4d9f0.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA56-C2
age: 413
etag: W/"31224-Gf78CYYYtb3Uvr+/+bTpOi3PB9M"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
edge-control: cache-maxage=60m,downstream-ttl=60m
cache-control: max-age=600, public
x-cache: Hit from cloudfront
x-amz-cf-id: 2nAUDuq5zO4u4DdPZM2wyH7jKKO5tQs_T6ySH3-dlts7_AY41vTX1Q==

GET
H2 200 systemPageComponents.min.css
www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Content/Bundles/Public/ 8 KB
2 KB 167ms
166ms Stylesheet
text/css 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Content/Bundles/Public/systemPageComponents.min.css

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

94770d87b50fde93195e509ed623e41f00da035ab7a08b2399c3cf219e95a1c4

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
via: None
date: Wed, 01 Feb 2023 13:45:50 GMT
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 05 Oct 2022 12:15:32 GMT
server: Apache
etag: "1d8d8b42a21d57d"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 base.css
www.bancfirst.bank/assets/ 435 KB
86 KB 167ms
167ms Stylesheet
text/css 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/assets/base.css?v=35

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

a34f9a58c540d773e7c14e45a6c23422e12641981954ec8bfb36b805780975ba

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
via: None
date: Wed, 01 Feb 2023 13:45:50 GMT
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 18 Oct 2022 14:58:24 GMT
server: Apache
etag: "1d8e3021217a492"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 logo.svg
www.bancfirst.bank/Content/Images/ 15 KB
15 KB 458ms
457ms Image
image/svg+xml 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/Content/Images/logo.svg

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

488844f5d5f2c946db78f9af197b845224d010ed45663145e862bb73a9c3fdb2

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 01 Feb 2023 13:45:50 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
content-length: 14994
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 18 Oct 2022 14:57:32 GMT
server: Apache
etag: "1d8e301f312ec92"
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 227 KB
71 KB 154ms
66ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PP7Q5WN

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4794032def638ab4df53d4912e9d07b75e7966cbe5ba4365b243b8be1b836f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Wed, 01 Feb 2023 13:45:50 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72356
x-xss-protection: 0
last-modified: Wed, 01 Feb 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 01 Feb 2023 13:45:50 GMT

GET
H2 200 personal-debit-cards.jpg
www.bancfirst.bank/getmedia/8942a457-8225-4fc4-a413-8fe8521aa671/ 48 KB
48 KB 476ms
474ms Image
image/jpeg 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/getmedia/8942a457-8225-4fc4-a413-8fe8521aa671/personal-debit-cards.jpg?width=510&height=270&ext=.jpg

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

ebce57e734e59300db2643d9632e5db7a6b4793bda76f46bfcc685f2a80308fc

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 01 Feb 2023 13:45:50 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
content-disposition: inline; filename=personal-debit-cards.jpg
x-forwarded-proto: $scheme;
content-length: 48845
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 02 Dec 2020 21:01:48 GMT
server: Apache
etag: "637425181089245118"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
expires: Wed, 01 Feb 2023 13:45:47 GMT

GET
H2 200 business-debit-cards.jpg
www.bancfirst.bank/getmedia/33d54a37-6a2b-4db3-aa1e-a5909c4ca247/ 32 KB
32 KB 477ms
475ms Image
image/jpeg 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/getmedia/33d54a37-6a2b-4db3-aa1e-a5909c4ca247/business-debit-cards.jpg?width=510&height=270&ext=.jpg

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

a9a3f85b17678ff637c166a3b65d4d0658005bf81e4439808018c202213832e0

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 01 Feb 2023 13:45:50 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
content-disposition: inline; filename=business-debit-cards.jpg
x-forwarded-proto: $scheme;
content-length: 32430
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 02 Dec 2020 21:01:48 GMT
server: Apache
etag: "637425181083254963"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
expires: Wed, 01 Feb 2023 13:45:47 GMT

GET
H2 200 loyalty-checking.jpg
www.bancfirst.bank/getmedia/bc1e869a-88bc-4c1e-8c99-a9ac9502b06b/ 34 KB
35 KB 476ms
474ms Image
image/jpeg 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/getmedia/bc1e869a-88bc-4c1e-8c99-a9ac9502b06b/loyalty-checking.jpg?width=510&height=270&ext=.jpg

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

562a4261ce490cc7b569dc58915add9691fc3c64143e0c8283843f08a24ce8b6

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 01 Feb 2023 13:45:50 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
content-disposition: inline; filename=loyalty-checking.jpg
x-forwarded-proto: $scheme;
content-length: 35074
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 02 Dec 2020 21:01:48 GMT
server: Apache
etag: "637425181085325000"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
expires: Wed, 01 Feb 2023 13:45:47 GMT

GET
H2 200 hp-community.jpg
www.bancfirst.bank/getmedia/28b35b83-3922-4a08-b5bd-58a1784b878e/ 180 KB
181 KB 477ms
475ms Image
image/jpeg 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/getmedia/28b35b83-3922-4a08-b5bd-58a1784b878e/hp-community.jpg?width=360&height=444&ext=.jpg

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

3806ac8a290d9f6f3dbea7a41fd827fcf625e4ce935e042d31c933c7468df423

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 01 Feb 2023 13:45:50 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
content-disposition: inline; filename=hp-community.jpg
x-forwarded-proto: $scheme;
content-length: 184334
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 02 Dec 2020 21:02:22 GMT
server: Apache
etag: "637425181423474016"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
expires: Wed, 01 Feb 2023 13:45:47 GMT

GET
H2 200 ehl.png
www.bancfirst.bank/Content/Images/ 2 KB
2 KB 330ms
328ms Image
image/png 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/Content/Images/ehl.png

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

cf380d3d57c6f269c1228465721edd60db00e1fc3d1bd5568bdde8477f6ff59a

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 01 Feb 2023 13:45:50 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
content-length: 2187
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 18 Oct 2022 14:57:32 GMT
server: Apache
etag: "1d8e301f312de8b"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 fdic.png
www.bancfirst.bank/Content/Images/ 4 KB
4 KB 329ms
328ms Image
image/png 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/Content/Images/fdic.png

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

e36a1706accaa88e75385084678d454ccf887c139ec4de1b0c7474a7381776de

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 01 Feb 2023 13:45:50 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
content-length: 3876
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 18 Oct 2022 14:57:32 GMT
server: Apache
etag: "1d8e301f312d924"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 google-play.png
www.bancfirst.bank/Content/Images/ 6 KB
6 KB 331ms
330ms Image
image/png 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/Content/Images/google-play.png

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

4d33f0a233d3abb125e700b5b40dda14e5d72db6ffa7d01188d7b61bdec00d45

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 01 Feb 2023 13:45:50 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
content-length: 6021
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 18 Oct 2022 14:57:32 GMT
server: Apache
etag: "1d8e301f312c185"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 app-store.png
www.bancfirst.bank/Content/Images/ 3 KB
3 KB 332ms
331ms Image
image/png 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/Content/Images/app-store.png

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

fe1de787b0ac87b545636b9f969ecabef35734b74ca17b5484246c7442afad0b

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 01 Feb 2023 13:45:50 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
content-length: 3356
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 18 Oct 2022 14:57:32 GMT
server: Apache
etag: "1d8e301f312db1c"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 jquery-3.5.1.js Show response
www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Scripts/ 292 KB
113 KB 330ms
329ms Script
application/javascript 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Scripts/jquery-3.5.1.js

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

a28d76c983b06d87eb2c6d6deaff7e1d4faf32f12794a92bd5e21c754c06ed9b

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
via: None
date: Wed, 01 Feb 2023 13:45:50 GMT
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 05 Oct 2022 12:15:32 GMT
server: Apache
etag: "1d8d8b42a254406"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 jquery.unobtrusive-ajax.js Show response
www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Scripts/ 4 KB
2 KB 330ms
329ms Script
application/javascript 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Scripts/jquery.unobtrusive-ajax.js

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

755f82e7a0f8a0c0ea3ed5806e77b6e4eb0a5e4b96d739f09602b51274e75461

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
via: None
date: Wed, 01 Feb 2023 13:45:50 GMT
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 05 Oct 2022 12:15:32 GMT
server: Apache
etag: "1d8d8b42a21c446"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 systemFormComponents.min.js Show response
www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Content/Bundles/Public/ 58 KB
24 KB 331ms
330ms Script
application/javascript 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/_content/Kentico.Content.Web.Rcl/Content/Bundles/Public/systemFormComponents.min.js

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

78f94aee3ab9895d5707a499d1ad149d80f627ce7193975c228f95f1f23c1cd2

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
via: None
date: Wed, 01 Feb 2023 13:45:50 GMT
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 05 Oct 2022 12:15:32 GMT
server: Apache
etag: "1d8d8b42a212ccd"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 base.js Show response
www.bancfirst.bank/assets/ 435 KB
179 KB 490ms
490ms Script
application/javascript 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/assets/base.js?v=35

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

7c937d5dcd73c56220ad616213711b5771892ade6a890654567b861b5900a81e

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
via: None
date: Wed, 01 Feb 2023 13:45:50 GMT
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Mon, 12 Dec 2022 21:15:30 GMT
server: Apache
etag: "1d90e6edce989fe"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 MerchantServices3.jpg
www.bancfirst.bank/getmedia/e4c55def-b39e-425d-b640-53be0798a8e5/ 161 KB
162 KB 469ms
468ms Image
image/jpeg 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/getmedia/e4c55def-b39e-425d-b640-53be0798a8e5/MerchantServices3.jpg?width=1366&height=911&ext=.jpg

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

82f934cc1adbc2ce3651e27cc1f8c929b4e2e81d87a213499ebc445f230d9adc

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 01 Feb 2023 13:45:50 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
content-disposition: inline; filename=MerchantServices3.jpg
x-forwarded-proto: $scheme;
content-length: 165078
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 27 Jan 2023 14:36:12 GMT
server: Apache
etag: "638104053720591968"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
expires: Wed, 01 Feb 2023 13:45:48 GMT

GET
H2 200 LoyaltyChecking_Best5Dollars.jpg
www.bancfirst.bank/getmedia/6790b1ef-f9e9-415d-b7d5-d5a91c67faeb/ 432 KB
434 KB 469ms
468ms Image
image/jpeg 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/getmedia/6790b1ef-f9e9-415d-b7d5-d5a91c67faeb/LoyaltyChecking_Best5Dollars.jpg?width=1575&height=750&ext=.jpg

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

30a180a7b0d21eb4062cfadc06b0309937db1b40a07633c0aab643b8f3b6c455

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 01 Feb 2023 13:45:50 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
content-disposition: inline; filename=LoyaltyChecking_Best5Dollars.jpg
x-forwarded-proto: $scheme;
content-length: 442549
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 27 Jan 2023 14:37:01 GMT
server: Apache
etag: "638104054215939069"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
expires: Wed, 01 Feb 2023 13:45:48 GMT

GET
H2 200 FraudPrevention-Business.jpg
www.bancfirst.bank/getmedia/45f5cf88-4477-42d4-99d1-67fe6ff5ad7e/ 447 KB
448 KB 468ms
467ms Image
image/jpeg 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/getmedia/45f5cf88-4477-42d4-99d1-67fe6ff5ad7e/FraudPrevention-Business.jpg?width=1575&height=750&ext=.jpg

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

b5fdcf96c8843ab785fb4eaf3e82561346ae8d41d86ce69f236c17019db65439

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 01 Feb 2023 13:45:50 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
content-disposition: inline; filename=FraudPrevention-Business.jpg
x-forwarded-proto: $scheme;
content-length: 457713
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 27 Jan 2023 14:37:42 GMT
server: Apache
etag: "638104054629450900"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
expires: Wed, 01 Feb 2023 13:45:48 GMT

GET
H2 200 DebitCardRewards.jpg
www.bancfirst.bank/getmedia/45230073-7a10-4d84-939b-989df8b36df5/ 456 KB
457 KB 468ms
467ms Image
image/jpeg 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/getmedia/45230073-7a10-4d84-939b-989df8b36df5/DebitCardRewards.jpg?width=1575&height=750&ext=.jpg

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

f6d71fae96a37e3af5979ee49d2e4f6d4bbb112e3f28ff70a00853d2c7d095e9

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 01 Feb 2023 13:45:50 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
content-disposition: inline; filename=DebitCardRewards.jpg
x-forwarded-proto: $scheme;
content-length: 466794
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 27 Jan 2023 14:38:21 GMT
server: Apache
etag: "638104055017911990"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
expires: Wed, 01 Feb 2023 13:45:48 GMT

GET
H2 200 5f8dcf1b3b070c0012e34660.js Show response
buttons-config.sharethis.com/js/ 475 B
921 B 547ms
439ms Script
text/javascript 2600:9000:206f:0:c:abe:f440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://buttons-config.sharethis.com/js/5f8dcf1b3b070c0012e34660.js

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:206f:0:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

9f9f9309a105891cafd375d6898e28f4f3b16fa11497d7d1cafa8e1102e624b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Wed, 01 Feb 2023 13:45:51 GMT
via: 1.1 29d33c5cd70a6501fde7bc2dba557906.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Mon, 19 Oct 2020 19:54:14 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
etag: "8c4cfb530c79fe050eb48be8f77d6536"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: text/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 475
x-amz-cf-id: PAtrVDWELH9LwfhzRTpDJR0ExI1lZ7fsx7QIXh8F9uqNglOfvU5JIw==

GET
H/1.1 204
No Content pview Show response
l.sharethis.com/ 0
405 B 174ms
42ms XHR
text/plain 3.120.54.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://l.sharethis.com/pview?event=pview&hostname=www.bancfirst.bank&location=%2F&product=inline-share-buttons&url=https%3A%2F%2Fwww.bancfirst.bank%2F&source=sharethis.js&fcmp=false&fcmpv2=false&has_segmentio=false&title=BancFirst%20%7C%20Bank%20in%20Oklahoma%20%7C%20Accounts%20%7C%20Loans%20%7C%20BancFirst&cms=unknown&publisher=5f8dcf1b3b070c0012e34660&sop=true&version=st_sop.js&lang=en&ua=&ua_mobile=false&ua_full_version_list=

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.120.54.96 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-120-54-96.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Wed, 01 Feb 2023 13:45:50 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains;
Access-Control-Max-Age: 1728000
Access-Control-Allow-Origin: https://www.bancfirst.bank
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 178ms
52ms Script
text/javascript 2a00:1450:400d:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PP7Q5WN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:802::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 01 Feb 2023 12:21:44 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 5046
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20085
expires: Wed, 01 Feb 2023 14:21:44 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 238 KB
79 KB 59ms
58ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-3DBMD34SP1&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PP7Q5WN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

62a14a2bab4ae9030629acdf32b68a484bd64a41978721143304f393b8b1589a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Wed, 01 Feb 2023 13:45:50 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 80758
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 01 Feb 2023 13:45:50 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
247 B 141ms
51ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-3DBMD34SP1&gtm=2oe1u0&_p=612342577&cid=819766901.1675259151&ul=en-us&sr=1600x1200&ir=1&uaW=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EA&_s=1&sid=1675259150&sct=1&seg=0&dl=https%3A%2F%2Fwww.bancfirst.bank%2F&dt=BancFirst%20%7C%20Bank%20in%20Oklahoma%20%7C%20Accounts%20%7C%20Loans%20%7C%20BancFirst&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-3DBMD34SP1&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Feb 2023 13:45:50 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bancfirst.bank
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
211 B 74ms
73ms XHR
text/plain 2a00:1450:400d:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&a=612342577&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bancfirst.bank%2F&ul=en-us&de=UTF-8&dt=BancFirst%20%7C%20Bank%20in%20Oklahoma%20%7C%20Accounts%20%7C%20Loans%20%7C%20BancFirst&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACEABBAAAACAAI~&jid=95292800&gjid=552614281&cid=819766901.1675259151&tid=UA-61103203-1&_gid=1800587505.1675259151&_r=1&_slc=1&gtm=2wg1u0PP7Q5WN&z=1292029199

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:802::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bancfirst.bank/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 01 Feb 2023 13:45:50 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bancfirst.bank
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v25/ 30 KB
31 KB 183ms
53ms Font
font/woff2 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,500;0,700;1,500;1,700&family=Satisfy&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.bancfirst.bank
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 01:49:16 GMT
x-content-type-options: nosniff
age: 474994
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30928
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:57:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 27 Jan 2024 01:49:16 GMT

GET
DATA 200
OK truncated
/ 134 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 93ee19994358156fbbe3bcbb748f51b8d5bd6199ff589f8955eaacfa59d5cb2c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 bg-pattern.png
www.bancfirst.bank/Content/Images/ 159 KB
159 KB 621ms
621ms Image
image/png 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bancfirst.bank/Content/Images/bg-pattern.png

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/assets/base.css?v=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

136c3395c2daf6c35d35ede610cde15d479b8862212b87b3d06fea3e84927a71

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bancfirst.bank/assets/base.css?v=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 01 Feb 2023 13:45:50 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
content-length: 162843
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 18 Oct 2022 14:57:32 GMT
server: Apache
etag: "1d8e301f310aa1b"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 fa-brands-400.woff2
www.bancfirst.bank/fonts/fontawesome-pro/webfonts/ 76 KB
76 KB 619ms
618ms Font
font/woff2 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/fonts/fontawesome-pro/webfonts/fa-brands-400.woff2

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/assets/base.css?v=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

479a88b36a9e0fd38bdfd22e19701576cd6cb01f36a21ce9935ad6a2d746e620

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bancfirst.bank/assets/base.css?v=35
Origin: https://www.bancfirst.bank
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 01 Feb 2023 13:45:50 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
content-length: 77452
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sat, 26 Oct 1985 10:15:00 GMT
server: Apache
etag: "1af6dcadbc0448c"
x-frame-options: SAMEORIGIN
content-type: font/woff2
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 fa-regular-400.woff2
www.bancfirst.bank/fonts/fontawesome-pro/webfonts/ 170 KB
170 KB 618ms
617ms Font
font/woff2 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/fonts/fontawesome-pro/webfonts/fa-regular-400.woff2

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/assets/base.css?v=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

a12ccfbc48872b90c3396cc47266a717a995665bb8a23a7fe982ad04432b8679

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bancfirst.bank/assets/base.css?v=35
Origin: https://www.bancfirst.bank
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 01 Feb 2023 13:45:50 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
content-length: 174348
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sat, 26 Oct 1985 10:15:00 GMT
server: Apache
etag: "1af6dcadbc3c30c"
x-frame-options: SAMEORIGIN
content-type: font/woff2
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 fa-light-300.woff2
www.bancfirst.bank/fonts/fontawesome-pro/webfonts/ 186 KB
186 KB 618ms
617ms Font
font/woff2 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/fonts/fontawesome-pro/webfonts/fa-light-300.woff2

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/assets/base.css?v=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

69885c352b73c062750dd828a00cb617eea070cd1053590cedd947a7b5d5b152

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bancfirst.bank/assets/base.css?v=35
Origin: https://www.bancfirst.bank
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 01 Feb 2023 13:45:50 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
content-length: 190452
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sat, 26 Oct 1985 10:15:00 GMT
server: Apache
etag: "1af6dcadbc38df4"
x-frame-options: SAMEORIGIN
content-type: font/woff2
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 fa-solid-900.woff2
www.bancfirst.bank/fonts/fontawesome-pro/webfonts/ 138 KB
139 KB 617ms
616ms Font
font/woff2 24.248.243.7
ASN-CXA-ALL-CCI-2...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bancfirst.bank/fonts/fontawesome-pro/webfonts/fa-solid-900.woff2

Requested by

Host: www.bancfirst.bank
URL: https://www.bancfirst.bank/assets/base.css?v=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

24.248.243.7 Tulsa, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US),

Reverse DNS

www.bancfirst.bank

Software

Apache / ASP.NET

Resource Hash

1c4076badc540e6416c97b7202cfb69b7c9b4a5f9750cbf01a0bd3b0ad6fecc9

Security Headers

Name	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bancfirst.bank/assets/base.css?v=35
Origin: https://www.bancfirst.bank
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 01 Feb 2023 13:45:50 GMT
via: None
x-content-type-options: nosniff
content-security-policy: script-src *.bancfirst.tv *.cloudflare.com *.googletagmanager.com *.sharethis.com *.basis.net *.wave2.io *.google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.bancfirst.bank *.googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' *.bancfirst.bank; worker-src blob:; script-src-elem *.bancfirst.bank *.cloudflare.com *.google.com *.googletagmanager.com *.gstatic.com *.sharethis.com *.google-analytics.com 'unsafe-inline' *.wave2.io *.wave2locator.com
x-powered-by: ASP.NET
x-forwarded-for: $proxy_add_x_forwarded_for;
x-forwarded-proto: $scheme;
content-length: 141672
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sat, 26 Oct 1985 10:15:00 GMT
server: Apache
etag: "1af6dcadbc34368"
x-frame-options: SAMEORIGIN
content-type: font/woff2
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes

GET
H2 200 rP2Hp2yn6lkG50LoCZOIHQ.woff2
fonts.gstatic.com/s/satisfy/v17/ 22 KB
22 KB 232ms
111ms Font
font/woff2 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/satisfy/v17/rP2Hp2yn6lkG50LoCZOIHQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,500;0,700;1,500;1,700&family=Satisfy&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a02009d2f95d79b62b95c6de12d6614bdb36bffa6d4e756db81ec1c51c5acc34

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.bancfirst.bank
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Mon, 30 Jan 2023 18:22:09 GMT
x-content-type-options: nosniff
age: 156221
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22652
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:12:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 30 Jan 2024 18:22:09 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
348 B 146ms
48ms XHR
text/plain 2a00:1450:400c:c0a::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-61103203-1&cid=819766901.1675259151&jid=95292800&gjid=552614281&_gid=1800587505.1675259151&_u=YCDACEAABAAAACAAI~&z=141547610

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0a::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bancfirst.bank/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Wed, 01 Feb 2023 13:45:50 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bancfirst.bank
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.bancfirst.bank/	1969-12-31 23:59:59	Name: .AspNetCore.Antiforgery.IbxhE25l3WQ Value: CfDJ8CbuoyDCa55BtegLOb6WoP3J_vkowsDdNij6xGaSfpFyq_OID3rEzl2iB5pHd-KYJarIFGlG1965cJ_CVWosS_RLseRHgSDbxrdRQa46AbGj8_kePP8z-B_dLe0RISpXqDGk2vfns-pUS5VCot-K-gU
.bancfirst.bank/	1970-01-20 18:56:59	Name: _ga_3DBMD34SP1 Value: GS1.1.1675259150.1.0.1675259150.0.0.0
.bancfirst.bank/	1970-01-20 18:56:59	Name: _ga Value: GA1.2.819766901.1675259151
.bancfirst.bank/	1970-01-20 09:22:25	Name: _gid Value: GA1.2.1800587505.1675259151
.bancfirst.bank/	1970-01-20 09:20:59	Name: _gat_UA-61103203-1 Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	script-src .bancfirst.tv .cloudflare.com .googletagmanager.com .sharethis.com .basis.net .wave2.io .google-analytics.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src .bancfirst.bank .googleapis.com 'unsafe-inline' ; object-src 'none'; frame-ancestors 'self' .bancfirst.bank; worker-src blob:; script-src-elem .bancfirst.bank .cloudflare.com .google.com .googletagmanager.com .gstatic.com .sharethis.com .google-analytics.com 'unsafe-inline' .wave2.io *.wave2locator.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bancfirst.com
buttons-config.sharethis.com
fonts.googleapis.com
fonts.gstatic.com
l.sharethis.com
platform-api.sharethis.com
region1.google-analytics.com
stats.g.doubleclick.net
www.bancfirst.bank
www.google-analytics.com
www.googletagmanager.com
13.32.27.7
2001:4860:4802:34::36
24.248.243.7
24.248.243.8
2600:9000:206f:0:c:abe:f440:93a1
2a00:1450:4001:806::2008
2a00:1450:4001:80b::200a
2a00:1450:400c:c0a::9a
2a00:1450:400d:802::200e
2a00:1450:400d:80a::2003
3.120.54.96
10d999f5bdecf7545e61e31f54c84f5938d5c0ed97e13d2f89e109282d1103c3
136c3395c2daf6c35d35ede610cde15d479b8862212b87b3d06fea3e84927a71
1c4076badc540e6416c97b7202cfb69b7c9b4a5f9750cbf01a0bd3b0ad6fecc9
30a180a7b0d21eb4062cfadc06b0309937db1b40a07633c0aab643b8f3b6c455
3806ac8a290d9f6f3dbea7a41fd827fcf625e4ce935e042d31c933c7468df423
4794032def638ab4df53d4912e9d07b75e7966cbe5ba4365b243b8be1b836f50
479a88b36a9e0fd38bdfd22e19701576cd6cb01f36a21ce9935ad6a2d746e620
488844f5d5f2c946db78f9af197b845224d010ed45663145e862bb73a9c3fdb2
4c762350bf5dcf159a3adfddb1c33d90a8d85daaf7c5de9ea82b5fd201dd2d5b
4d33f0a233d3abb125e700b5b40dda14e5d72db6ffa7d01188d7b61bdec00d45
562a4261ce490cc7b569dc58915add9691fc3c64143e0c8283843f08a24ce8b6
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
62a14a2bab4ae9030629acdf32b68a484bd64a41978721143304f393b8b1589a
69885c352b73c062750dd828a00cb617eea070cd1053590cedd947a7b5d5b152
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
755f82e7a0f8a0c0ea3ed5806e77b6e4eb0a5e4b96d739f09602b51274e75461
78f94aee3ab9895d5707a499d1ad149d80f627ce7193975c228f95f1f23c1cd2
7c937d5dcd73c56220ad616213711b5771892ade6a890654567b861b5900a81e
82f934cc1adbc2ce3651e27cc1f8c929b4e2e81d87a213499ebc445f230d9adc
93ee19994358156fbbe3bcbb748f51b8d5bd6199ff589f8955eaacfa59d5cb2c
94770d87b50fde93195e509ed623e41f00da035ab7a08b2399c3cf219e95a1c4
9f9f9309a105891cafd375d6898e28f4f3b16fa11497d7d1cafa8e1102e624b7
a02009d2f95d79b62b95c6de12d6614bdb36bffa6d4e756db81ec1c51c5acc34
a12ccfbc48872b90c3396cc47266a717a995665bb8a23a7fe982ad04432b8679
a28d76c983b06d87eb2c6d6deaff7e1d4faf32f12794a92bd5e21c754c06ed9b
a34f9a58c540d773e7c14e45a6c23422e12641981954ec8bfb36b805780975ba
a9a3f85b17678ff637c166a3b65d4d0658005bf81e4439808018c202213832e0
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b5fdcf96c8843ab785fb4eaf3e82561346ae8d41d86ce69f236c17019db65439
b944452f6df07e2e141bead92186e220d9f27b185643192d345c02004f69be7b
cf380d3d57c6f269c1228465721edd60db00e1fc3d1bd5568bdde8477f6ff59a
e36a1706accaa88e75385084678d454ccf887c139ec4de1b0c7474a7381776de
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ebce57e734e59300db2643d9632e5db7a6b4793bda76f46bfcc685f2a80308fc
f6d71fae96a37e3af5979ee49d2e4f6d4bbb112e3f28ff70a00853d2c7d095e9
fe1de787b0ac87b545636b9f969ecabef35734b74ca17b5484246c7442afad0b

www.bancfirst.bank Open in urlscan Pro 24.248.243.7 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

37 Requests

100 %HTTPS

64 %IPv6

8 Domains

11 Subdomains

11 IPs

4 Countries

3256 kBTransfer

4652 kBSize

5 Cookies

23 Outgoing links

Page URL History

Redirected requests

37 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.bancfirst.bank Open in urlscan Pro
24.248.243.7 Public Scan

Screenshot
Live screenshot

Full Image

37
Requests

100 %
HTTPS

64 %
IPv6

8
Domains

11
Subdomains

11
IPs

4
Countries

3256 kB
Transfer

4652 kB
Size

5
Cookies

37 HTTP transactions
1 data transactions