cesseguranca.com.br Open in urlscan Pro
15.235.39.189  Malicious Activity! Public Scan

URL: https://cesseguranca.com.br/mandt/
Submission: On October 25 via api from JP — Scanned from CA

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 24 HTTP transactions. The main IP is 15.235.39.189, located in Canada and belongs to OVH, FR. The main domain is cesseguranca.com.br.
TLS certificate: Issued by R3 on September 28th 2022. Valid for: 3 months.
This is the only time cesseguranca.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: M&T Bank (Banking)

Domain & IP information

Domain Requested by
17 cesseguranca.com.br cesseguranca.com.br
2 1.c81358859121583b7adf2ace89cb39f44.com cesseguranca.com.br
1.c81358859121583b7adf2ace89cb39f44.com
2 1.b406929acabac9b095f124c81bdfcf57f.com cesseguranca.com.br
1.b406929acabac9b095f124c81bdfcf57f.com
2 1.a79ab95c1589a13f8a4cab612bc71f9f7.com cesseguranca.com.br
1.a79ab95c1589a13f8a4cab612bc71f9f7.com
24 4

This site contains links to these domains. Also see Links.

Domain
wearesolidarite.com
Subject Issuer Validity Valid
cesseguranca.com.br
R3
2022-09-28 -
2022-12-27
3 months crt.sh
*.a79ab95c1589a13f8a4cab612bc71f9f7.com
Sectigo RSA Domain Validation Secure Server CA
2022-04-04 -
2023-04-04
a year crt.sh
*.b406929acabac9b095f124c81bdfcf57f.com
Sectigo RSA Domain Validation Secure Server CA
2022-04-06 -
2023-04-07
a year crt.sh
*.c81358859121583b7adf2ace89cb39f44.com
Sectigo RSA Domain Validation Secure Server CA
2022-04-06 -
2023-04-07
a year crt.sh

This page contains 4 frames:

Primary Page: https://cesseguranca.com.br/mandt/
Frame ID: EC8A51A7EFAB4D1030D1830AFC4BEB72
Requests: 22 HTTP requests in this frame

Frame: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Frame ID: B95DD900E9F947834CECCD8813886977
Requests: 2 HTTP requests in this frame

Frame: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Frame ID: 5E2919AA0B331B4E3226A117605855E2
Requests: 2 HTTP requests in this frame

Frame: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Frame ID: 96FB93239EFC74B977126DE01622F66A
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

Log in to M&T Online Banking or Commercial Treasury CenterNavigation Menu

Page Statistics

24
Requests

96 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

1723 kB
Transfer

1885 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

24 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
cesseguranca.com.br/mandt/
80 KB
81 KB
Document
General
Full URL
https://cesseguranca.com.br/mandt/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
56a6f99d8872d78782b4ca6da983ed70ea0a41973e604b21a1544c54a23fc427

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
82368
Content-Type
text/html
Date
Tue, 25 Oct 2022 20:10:43 GMT
Keep-Alive
timeout=5, max=100
Last-Modified
Wed, 31 Aug 2022 22:13:00 GMT
Server
Apache
clientlib-base.css
cesseguranca.com.br/mandt/index_files/
426 KB
427 KB
Stylesheet
General
Full URL
https://cesseguranca.com.br/mandt/index_files/clientlib-base.css
Requested by
Host: cesseguranca.com.br
URL: https://cesseguranca.com.br/mandt/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
0241159456863a6baa0790dfb58ab3c6dd892f080ee2a52259fb101f4c166412

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cesseguranca.com.br/mandt/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Tue, 25 Oct 2022 20:10:43 GMT
Last-Modified
Wed, 31 Aug 2022 10:43:12 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
436674
mtb_app_wbk.js.download
cesseguranca.com.br/mandt/index_files/
242 KB
243 KB
Script
General
Full URL
https://cesseguranca.com.br/mandt/index_files/mtb_app_wbk.js.download
Requested by
Host: cesseguranca.com.br
URL: https://cesseguranca.com.br/mandt/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
b9b7a642f229db0bbc0a820e1eee063041d03ab631f868e8106c1aa1c4647b75

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cesseguranca.com.br/mandt/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Tue, 25 Oct 2022 20:10:43 GMT
Last-Modified
Wed, 31 Aug 2022 10:43:12 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
248194
cdsession.js.download
cesseguranca.com.br/mandt/index_files/
605 KB
605 KB
Script
General
Full URL
https://cesseguranca.com.br/mandt/index_files/cdsession.js.download
Requested by
Host: cesseguranca.com.br
URL: https://cesseguranca.com.br/mandt/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
302462d4283c45e7405dcaf5036c9f1e34982c47baaa0a39c2b45e6cb9a203f4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cesseguranca.com.br/mandt/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Tue, 25 Oct 2022 20:10:43 GMT
Last-Modified
Wed, 31 Aug 2022 10:43:12 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
619717
vendor.js.download
cesseguranca.com.br/mandt/index_files/
236 KB
237 KB
Script
General
Full URL
https://cesseguranca.com.br/mandt/index_files/vendor.js.download
Requested by
Host: cesseguranca.com.br
URL: https://cesseguranca.com.br/mandt/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
c5bac5c06dfc6a8b1547af4e6dfa0d784f70db7c92cfe1e97c45e962f0283d0c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cesseguranca.com.br/mandt/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Tue, 25 Oct 2022 20:10:43 GMT
Last-Modified
Wed, 31 Aug 2022 10:43:12 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
242127
white%20logo.png
cesseguranca.com.br/mandt/index_files/
5 KB
5 KB
Image
General
Full URL
https://cesseguranca.com.br/mandt/index_files/white%20logo.png
Requested by
Host: cesseguranca.com.br
URL: https://cesseguranca.com.br/mandt/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
68d12e8086357835fc398c26ffc15a2ad73d6c1ceb930e545982149af754e652

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cesseguranca.com.br/mandt/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Tue, 25 Oct 2022 20:10:44 GMT
Last-Modified
Wed, 31 Aug 2022 10:43:12 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
4936
equal-housing-lender-logo.png
cesseguranca.com.br/mandt/index_files/
1 KB
2 KB
Image
General
Full URL
https://cesseguranca.com.br/mandt/index_files/equal-housing-lender-logo.png
Requested by
Host: cesseguranca.com.br
URL: https://cesseguranca.com.br/mandt/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
46c43686825a8cb8bf832253977abfb4871e5d9014cb6912e8519c736a6253d3

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cesseguranca.com.br/mandt/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Tue, 25 Oct 2022 20:10:44 GMT
Last-Modified
Wed, 31 Aug 2022 10:43:14 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
1509
fszullhwyai6bvj-desktop-720x816-update.jpeg
cesseguranca.com.br/mandt/index_files/
111 KB
111 KB
Image
General
Full URL
https://cesseguranca.com.br/mandt/index_files/fszullhwyai6bvj-desktop-720x816-update.jpeg
Requested by
Host: cesseguranca.com.br
URL: https://cesseguranca.com.br/mandt/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
e3600cc522d109bf4d7aeb56960790240e80d9f22f6ae99e9a77d020bdf8f3cd

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cesseguranca.com.br/mandt/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Tue, 25 Oct 2022 20:10:44 GMT
Last-Modified
Wed, 31 Aug 2022 10:43:14 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
113904
fszullhwyai6bvj.jpeg
cesseguranca.com.br/mandt/index_files/
315 B
315 B
Image
General
Full URL
https://cesseguranca.com.br/mandt/index_files/fszullhwyai6bvj.jpeg
Requested by
Host: cesseguranca.com.br
URL: https://cesseguranca.com.br/mandt/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cesseguranca.com.br/mandt/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Tue, 25 Oct 2022 20:10:44 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=98
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
mandtbaltoweb-book.woff
cesseguranca.com.br/mandt/index_files/clientlib-site/resources/fonts/MTB_Balto/Webfonts/
0
0
Font
General
Full URL
https://cesseguranca.com.br/mandt/index_files/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-book.woff
Requested by
Host: cesseguranca.com.br
URL: https://cesseguranca.com.br/mandt/index_files/clientlib-base.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash

Request headers

Referer
https://cesseguranca.com.br/mandt/index_files/clientlib-base.css
Origin
https://cesseguranca.com.br
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Tue, 25 Oct 2022 20:10:44 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
7d0933db-85b9-471a-b990-2113afb1bb20
https://cesseguranca.com.br/
165 KB
0
Other
General
Full URL
blob:https://cesseguranca.com.br/7d0933db-85b9-471a-b990-2113afb1bb20
Requested by
Host: cesseguranca.com.br
URL: https://cesseguranca.com.br/mandt/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
25e521f17135f161c1f02f0555af227292ab009967c461380e3135c414f288e6

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Length
169098
mandtbaltoweb-book.woff
cesseguranca.com.br/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/
0
0
Font
General
Full URL
https://cesseguranca.com.br/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-book.woff
Requested by
Host: cesseguranca.com.br
URL: https://cesseguranca.com.br/mandt/index_files/clientlib-base.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash

Request headers

Referer
https://cesseguranca.com.br/mandt/index_files/clientlib-base.css
Origin
https://cesseguranca.com.br
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Tue, 25 Oct 2022 20:10:44 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=98
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
chevron_down.8adc6731.svg
cesseguranca.com.br/mandt/css/
315 B
315 B
Image
General
Full URL
https://cesseguranca.com.br/mandt/css/chevron_down.8adc6731.svg
Requested by
Host: cesseguranca.com.br
URL: https://cesseguranca.com.br/mandt/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cesseguranca.com.br/mandt/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Tue, 25 Oct 2022 20:10:44 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=97
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
mandtbaltoweb-light.woff
cesseguranca.com.br/mandt/index_files/clientlib-site/resources/fonts/MTB_Balto/Webfonts/
0
0
Font
General
Full URL
https://cesseguranca.com.br/mandt/index_files/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-light.woff
Requested by
Host: cesseguranca.com.br
URL: https://cesseguranca.com.br/mandt/index_files/clientlib-base.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash

Request headers

Referer
https://cesseguranca.com.br/mandt/index_files/clientlib-base.css
Origin
https://cesseguranca.com.br
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Tue, 25 Oct 2022 20:10:44 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=97
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
mandtbaltoweb-medium.woff
cesseguranca.com.br/mandt/index_files/clientlib-site/resources/fonts/MTB_Balto/Webfonts/
0
0
Font
General
Full URL
https://cesseguranca.com.br/mandt/index_files/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-medium.woff
Requested by
Host: cesseguranca.com.br
URL: https://cesseguranca.com.br/mandt/index_files/clientlib-base.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash

Request headers

Referer
https://cesseguranca.com.br/mandt/index_files/clientlib-base.css
Origin
https://cesseguranca.com.br
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Tue, 25 Oct 2022 20:10:44 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=97
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
fszullhwyai6bvj-desktop-720x816-update.jpeg
cesseguranca.com.br/mandt/css/
315 B
315 B
Image
General
Full URL
https://cesseguranca.com.br/mandt/css/fszullhwyai6bvj-desktop-720x816-update.jpeg
Requested by
Host: cesseguranca.com.br
URL: https://cesseguranca.com.br/mandt/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cesseguranca.com.br/mandt/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Tue, 25 Oct 2022 20:10:44 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=96
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
mandtbaltoweb-light.woff
cesseguranca.com.br/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/
0
0
Font
General
Full URL
https://cesseguranca.com.br/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-light.woff
Requested by
Host: cesseguranca.com.br
URL: https://cesseguranca.com.br/mandt/index_files/clientlib-base.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash

Request headers

Referer
https://cesseguranca.com.br/mandt/index_files/clientlib-base.css
Origin
https://cesseguranca.com.br
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Tue, 25 Oct 2022 20:10:44 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=95
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
mandtbaltoweb-medium.woff
cesseguranca.com.br/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/
0
0
Font
General
Full URL
https://cesseguranca.com.br/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-medium.woff
Requested by
Host: cesseguranca.com.br
URL: https://cesseguranca.com.br/mandt/index_files/clientlib-base.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash

Request headers

Referer
https://cesseguranca.com.br/mandt/index_files/clientlib-base.css
Origin
https://cesseguranca.com.br
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Tue, 25 Oct 2022 20:10:44 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=96
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
crossdomain.html
1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/ Frame B95D
221 B
557 B
Document
General
Full URL
https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Requested by
Host: cesseguranca.com.br
URL: https://cesseguranca.com.br/mandt/index_files/cdsession.js.download
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:210b:7e00:a:6cdf:4440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer
https://cesseguranca.com.br/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
49599
content-length
221
content-type
text/html
date
Tue, 25 Oct 2022 06:24:06 GMT
etag
"21e34cf6a03f570df49e212018a567d0"
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
via
1.1 6886c621d4716e156349149ba8d65b40.cloudfront.net (CloudFront)
x-amz-cf-id
YnORvvXIpXT2PIiR6qWv6JxCoeccW-Zkx0-i7fIlNHXNTcEx1Zi4ZA==
x-amz-cf-pop
EWR53-C3
x-amz-version-id
null
x-cache
Hit from cloudfront
crossdomain.html
1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/ Frame 5E29
221 B
556 B
Document
General
Full URL
https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Requested by
Host: cesseguranca.com.br
URL: https://cesseguranca.com.br/mandt/index_files/cdsession.js.download
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2510:6000:1e:54f1:26c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer
https://cesseguranca.com.br/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
25662
content-length
221
content-type
text/html
date
Tue, 25 Oct 2022 13:03:03 GMT
etag
"21e34cf6a03f570df49e212018a567d0"
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
via
1.1 53a1f042d35b1ad7e45dd18908041b36.cloudfront.net (CloudFront)
x-amz-cf-id
7wzvJVx0c7RfU_GtkXYj9frtZXwDcz0YVsUYoahIuh3vvKQTArGbzA==
x-amz-cf-pop
JFK50-P5
x-amz-version-id
null
x-cache
Hit from cloudfront
crossdomain.html
1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/ Frame 96FB
221 B
556 B
Document
General
Full URL
https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Requested by
Host: cesseguranca.com.br
URL: https://cesseguranca.com.br/mandt/index_files/cdsession.js.download
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2120:2000:13:ab57:d440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer
https://cesseguranca.com.br/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
33228
content-length
221
content-type
text/html
date
Tue, 25 Oct 2022 10:56:57 GMT
etag
"21e34cf6a03f570df49e212018a567d0"
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
via
1.1 49830f6fdfb2c3519e81248d6d19f450.cloudfront.net (CloudFront)
x-amz-cf-id
mo4zANRUEufM7R681LZmBK6PjJaLIS2tr1Z0_72KGUpktZBrWV0ufQ==
x-amz-cf-pop
EWR52-C4
x-amz-version-id
null
x-cache
Hit from cloudfront
truncated
/
89 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
57ee66d6881fce332c78d4375c076e11097d4e68eebca5f5a0571d6f1a548752

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
89 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bc346c96512732e413b319a7e078cb1252d0e6eef83dd9d2bc6d21064ea82048

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
89 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
20020c94029d55bd3ac12a9514c665f3d52995a2ecf24e2fc2e690d65aa2f915

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
89 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6a3cb2863d8c6093e792031c3c347424c08cab478afc3a6564ae27663b90c6d9

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/png
crossdomain2.12.0.5273.b96c35cc.min.js
1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/ Frame 5E29
3 KB
3 KB
Script
General
Full URL
https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by
Host: 1.b406929acabac9b095f124c81bdfcf57f.com
URL: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2510:6000:1e:54f1:26c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-amz-version-id
null
date
Tue, 25 Oct 2022 04:47:48 GMT
via
1.1 53a1f042d35b1ad7e45dd18908041b36.cloudfront.net (CloudFront)
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
x-amz-cf-pop
JFK50-P5
age
55377
etag
"9ee48a4da9c402e8a23ad085fb71f28f"
x-cache
Hit from cloudfront
content-type
application/javascript
accept-ranges
bytes
content-length
3227
x-amz-cf-id
hS1LxPzhGFEuH_IAY8jrqDI7GGZ9W5jJ021n6BRmXaSo6koYhGeWWg==
crossdomain2.12.0.5273.b96c35cc.min.js
1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/ Frame 96FB
3 KB
3 KB
Script
General
Full URL
https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by
Host: 1.c81358859121583b7adf2ace89cb39f44.com
URL: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2120:2000:13:ab57:d440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-amz-version-id
null
date
Tue, 25 Oct 2022 06:22:55 GMT
via
1.1 49830f6fdfb2c3519e81248d6d19f450.cloudfront.net (CloudFront)
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
x-amz-cf-pop
EWR52-C4
age
49670
etag
"9ee48a4da9c402e8a23ad085fb71f28f"
x-cache
Hit from cloudfront
content-type
application/javascript
accept-ranges
bytes
content-length
3227
x-amz-cf-id
sKoiRp3gzu-AVKyLY-NU3pXCvIhS1RcuPp5db7B9IxJUZAgbuCrErw==
crossdomain2.12.0.5273.b96c35cc.min.js
1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/ Frame B95D
3 KB
3 KB
Script
General
Full URL
https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by
Host: 1.a79ab95c1589a13f8a4cab612bc71f9f7.com
URL: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:210b:7e00:a:6cdf:4440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-amz-version-id
null
date
Tue, 25 Oct 2022 13:11:34 GMT
via
1.1 6886c621d4716e156349149ba8d65b40.cloudfront.net (CloudFront)
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
x-amz-cf-pop
EWR53-C3
age
25151
etag
"9ee48a4da9c402e8a23ad085fb71f28f"
x-cache
Hit from cloudfront
content-type
application/javascript
accept-ranges
bytes
content-length
3227
x-amz-cf-id
FxID8qXqVAuAJ_5gSUnmQWkCEgJUjqMEcSyUfTaUGJUBPV58rScZvg==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: M&T Bank (Banking)

75 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| UIEvent object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| cdwpb object| cdApi object| Utils object| customEventsObject object| cookiesUtils object| modalObject object| tealiumUtils function| Hashtable function| startsWith function| DomDataCollection function| IE_FingerPrint function| Mozilla_FingerPrint function| Opera_FingerPrint function| Timer function| getRandomPort object| ProxyCollector function| BlackberryLocationCollector function| detectFields string| SEP string| PAIR string| DEV function| FingerPrint function| urlEncode function| encode_deviceprint function| decode_deviceprint function| post_deviceprint function| post_fingerprints function| add_deviceprint function| form_add_data function| form_add_deviceprint string| HTML5 string| BLACKBERRY string| UNDEFINED string| GEO_LOCATION_DEFAULT_STRUCT object| geoLocator boolean| geoLocatorStatus function| detectDeviceCollectionAPIMode function| init function| startCollection function| stopCollection function| getGeolocationStruct function| HTML5LocationCollector object| UIEventCollector function| InteractionElement function| UIElementList function| activeXDetect function| stripIllegalChars function| stripFullPath object| BrowserDetect function| convertTimestampToGMT function| getTimestampInMillis function| debug function| $ function| jQuery function| Cookies function| forceIE89Synchronicity object| lazySizes function| webkitAudioContext function| populateUserId function| cdSession string| style string| d string| t string| m object| s

4 Cookies

Domain/Path Name / Value
cesseguranca.com.br/mandt Name: cdSessionId
Value: 85d7d1d1-a903-4466-a336-dddd05bdcff4
.cesseguranca.com.br/ Name: cdContextId
Value: 1
.cesseguranca.com.br/ Name: bmuid
Value: 1666728644277-2D557FA6-6F59-4CD2-A539-B2D536A5B152
.cesseguranca.com.br/ Name: cdSNum
Value: 1666728644502-sjn0000194-00c98318-245d-4c85-8d4e-38d8ea81848b

15 Console Messages

Source Level URL
Text
network error URL: https://cesseguranca.com.br/mandt/index_files/fszullhwyai6bvj.jpeg
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://cesseguranca.com.br/mandt/index_files/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-book.woff
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://cesseguranca.com.br/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-book.woff
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://cesseguranca.com.br/mandt/css/chevron_down.8adc6731.svg
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://cesseguranca.com.br/mandt/index_files/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-light.woff
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://cesseguranca.com.br/mandt/index_files/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-medium.woff
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://cesseguranca.com.br/mandt/css/fszullhwyai6bvj-desktop-720x816-update.jpeg
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://cesseguranca.com.br/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-light.woff
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://cesseguranca.com.br/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-medium.woff
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
rendering warning URL: https://cesseguranca.com.br/mandt/(Line 124)
Message:
Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
rendering warning URL: https://cesseguranca.com.br/mandt/(Line 124)
Message:
Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
rendering warning URL: https://cesseguranca.com.br/mandt/(Line 124)
Message:
Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
rendering warning URL: https://cesseguranca.com.br/mandt/(Line 124)
Message:
Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
rendering warning URL: https://cesseguranca.com.br/mandt/(Line 124)
Message:
Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
rendering warning URL: https://cesseguranca.com.br/mandt/(Line 124)
Message:
Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently