cn.skyswordone.com Open in urlscan Pro
2606:4700:3030::6815:48cd  Malicious Activity! Public Scan

URL: http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
Submission: On September 10 via manual from IN — Scanned from DE

Summary

This website contacted 14 IPs in 3 countries across 11 domains to perform 40 HTTP transactions. The main IP is 2606:4700:3030::6815:48cd, located in United States and belongs to CLOUDFLARENET, US. The main domain is cn.skyswordone.com.
This is the only time cn.skyswordone.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online) M&T Bank (Banking)

Domain & IP information

IP Address AS Autonomous System
1 7 2606:4700:303... 13335 (CLOUDFLAR...)
4 24.75.29.69 16490 (MTB)
8 24.75.29.77 3356 (LEVEL3)
1 107.162.179.174 55002 (DEFENSE-NET)
3 104.75.88.194 16625 (AKAMAI-AS)
1 2 2606:4700:10:... 13335 (CLOUDFLAR...)
1 2 15.188.95.229 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 216.58.212.130 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
7 34.67.142.127 396982 (GOOGLE-CL...)
40 14
Apex Domain
Subdomains
Transfer
12 mtb.com
onlinebanking.mtb.com — Cisco Umbrella Rank: 221190 Failed
resources.mtb.com — Cisco Umbrella Rank: 355989
543 KB
9 quantummetric.com
cdn.quantummetric.com — Cisco Umbrella Rank: 2914
mtb-app.quantummetric.com — Cisco Umbrella Rank: 203243
80 KB
7 skyswordone.com
cn.skyswordone.com
18 KB
3 tiqcdn.com
tags.tiqcdn.com — Cisco Umbrella Rank: 1165
36 KB
2 omtrdc.net
mtb.d1.sc.omtrdc.net — Cisco Umbrella Rank: 127249
2 KB
1 google.de
www.google.de — Cisco Umbrella Rank: 3469
548 B
1 google.com
www.google.com — Cisco Umbrella Rank: 19
548 B
1 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 73
2 KB
1 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 159
16 KB
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 141
46 KB
1 zeronaught.com
ponos.zeronaught.com — Cisco Umbrella Rank: 12346
1 KB
40 11
Domain Requested by
8 resources.mtb.com cn.skyswordone.com
resources.mtb.com
7 mtb-app.quantummetric.com cdn.quantummetric.com
7 cn.skyswordone.com 1 redirects cn.skyswordone.com
onlinebanking.mtb.com
4 onlinebanking.mtb.com cn.skyswordone.com
3 tags.tiqcdn.com onlinebanking.mtb.com
tags.tiqcdn.com
2 mtb.d1.sc.omtrdc.net 1 redirects cn.skyswordone.com
2 cdn.quantummetric.com 1 redirects cn.skyswordone.com
1 www.google.de cn.skyswordone.com
1 www.google.com cn.skyswordone.com
1 googleads.g.doubleclick.net www.googleadservices.com
1 www.googleadservices.com www.googletagmanager.com
1 www.googletagmanager.com tags.tiqcdn.com
1 ponos.zeronaught.com onlinebanking.mtb.com
40 13

This site contains links to these domains. Also see Links.

Domain
www.mtb.com
onlinebanking.mtb.com
upgrade.mtb.com
asset.mtb.com
mtb.com
Subject Issuer Validity Valid
onlinebanking.mtb.com
Entrust Certification Authority - L1M
2022-07-25 -
2023-08-24
a year crt.sh
resources.mtb.com
Entrust Certification Authority - L1M
2022-05-11 -
2023-05-27
a year crt.sh
*.zeronaught.com
Go Daddy Secure Certificate Authority - G2
2021-11-13 -
2022-11-11
a year crt.sh
*.tiqcdn.com
DigiCert SHA2 Secure Server CA
2022-02-27 -
2023-02-28
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2022-08-22 -
2022-11-14
3 months crt.sh
www.googleadservices.com
GTS CA 1C3
2022-08-22 -
2022-11-14
3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2022-08-22 -
2022-11-14
3 months crt.sh
www.google.com
GTS CA 1C3
2022-08-22 -
2022-11-14
3 months crt.sh
www.google.de
GTS CA 1C3
2022-08-22 -
2022-11-14
3 months crt.sh
*.quantummetric.com
Sectigo RSA Domain Validation Secure Server CA
2022-01-18 -
2023-02-13
a year crt.sh

This page contains 2 frames:

Primary Page: http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
Frame ID: 0780A7B6ECED6564C63D22B4CDD0C689
Requests: 34 HTTP requests in this frame

Frame: https://mtb-app.quantummetric.com/?T=B&u=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&t=1662809603809&v=1662809604263&z=1&S=0&N=0&P=0
Frame ID: A21B730B0B48A662FF84CFD5EB75D862
Requests: 7 HTTP requests in this frame

Screenshot

Page Title

Welcome to Online Banking | M&T Bank

Page URL History Show full URLs

  1. http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm Page URL
  2. http://cn.skyswordone.com/cdn-cgi/phish-bypass?atok=XkkWxuhO1vrKcLFK2m6UKVowU6QwcEqmlvelugAtlTM-166280... HTTP 301
    http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Page Statistics

40
Requests

65 %
HTTPS

46 %
IPv6

11
Domains

13
Subdomains

14
IPs

3
Countries

741 kB
Transfer

1800 kB
Size

25
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm Page URL
  2. http://cn.skyswordone.com/cdn-cgi/phish-bypass?atok=XkkWxuhO1vrKcLFK2m6UKVowU6QwcEqmlvelugAtlTM-1662809596-0-%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm HTTP 301
    http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 21
  • http://cdn.quantummetric.com/qscripts/quantum-mtb.js HTTP 301
  • https://cdn.quantummetric.com/qscripts/quantum-mtb.js
Request Chain 23
  • http://mtb.d1.sc.omtrdc.net/b/ss/mtb/1/JS-2.9.0/s38600436800397?AQB=1&ndh=1&pf=1&t=10%2F8%2F2022%2011%3A33%3A22%206%200&fid=66C54E7516A63C47-3DBE5B1F0EFFF476&ce=UTF-8&pageName=OLB%3ALogin%3AIndex&g=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&r=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&cc=USD&events=event21&c16=no%20value&c17=Saturday%3A7%3A30AM&v19=D%3Dc17&c20=D%3Dg&c21=1&v21=D%3Dg&c22=New&v22=1&c23=First%20Visit&v23=New&v24=First%20Visit&v26=stop&v27=D%3DpageName&c41=OLB&v41=OLB&v136=1662809602564&v151=Tealium&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 HTTP 302
  • http://mtb.d1.sc.omtrdc.net/b/ss/mtb/1/JS-2.9.0/s38600436800397?AQB=1&pccr=true&ndh=1&pf=1&t=10%2F8%2F2022%2011%3A33%3A22%206%200&fid=66C54E7516A63C47-3DBE5B1F0EFFF476&ce=UTF-8&pageName=OLB%3ALogin%3AIndex&g=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&r=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&cc=USD&events=event21&c16=no%20value&c17=Saturday%3A7%3A30AM&v19=D%3Dc17&c20=D%3Dg&c21=1&v21=D%3Dg&c22=New&v22=1&c23=First%20Visit&v23=New&v24=First%20Visit&v26=stop&v27=D%3DpageName&c41=OLB&v41=OLB&v136=1662809602564&v151=Tealium&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

40 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
index.htm
cn.skyswordone.com/cgi-etc/vip/mtbnemail/
5 KB
3 KB
Document
General
Full URL
http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
Protocol
HTTP/1.1
Server
2606:4700:3030::6815:48cd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4c68766dbc64c763b86ec0161dbadffe14c9614e6af96ccdddb9b09d4de09743
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

CF-RAY
7487d9077a28baa5-MXP
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Sat, 10 Sep 2022 11:33:16 GMT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hK6XfMGCN7Sm2JNEZ%2FVwE%2BDLCHbd2o8Z59Dn9vAP2U%2BSiVLL1Ipkjdr9d9%2BIXvLlOELgRIunYCTJXxACL%2BNVNdwMEt1wfuo3ecs8eJLHF9m736UDCMHOjKToCV4rKu6H1vXJ2r3oSz08xi2KvlPTzgo%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf.errors.css
cn.skyswordone.com/cdn-cgi/styles/
24 KB
5 KB
Stylesheet
General
Full URL
http://cn.skyswordone.com/cdn-cgi/styles/cf.errors.css
Requested by
Host: cn.skyswordone.com
URL: http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
Protocol
HTTP/1.1
Server
2606:4700:3030::6815:48cd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 11:33:16 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Tue, 06 Sep 2022 17:30:38 GMT
Server
cloudflare
ETag
W/"631783be-5e44"
X-Frame-Options
DENY
Content-Type
text/css
Cache-Control
max-age=7200, public
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
7487d907baa7baa5-MXP
Vary
Accept-Encoding
Expires
Sat, 10 Sep 2022 13:33:16 GMT
icon-exclamation.png
cn.skyswordone.com/cdn-cgi/images/
452 B
889 B
Image
General
Full URL
http://cn.skyswordone.com/cdn-cgi/images/icon-exclamation.png?1376755637
Requested by
Host: cn.skyswordone.com
URL: http://cn.skyswordone.com/cdn-cgi/styles/cf.errors.css
Protocol
HTTP/1.1
Server
2606:4700:3030::6815:48cd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/cdn-cgi/styles/cf.errors.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 11:33:16 GMT
X-Content-Type-Options
nosniff
Last-Modified
Tue, 06 Sep 2022 17:30:38 GMT
Server
cloudflare
ETag
"631783be-1c4"
X-Frame-Options
DENY
Content-Type
image/png
Cache-Control
max-age=7200, public
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
7487d907fb23baa5-MXP
Vary
Accept-Encoding
Content-Length
452
Expires
Sat, 10 Sep 2022 13:33:16 GMT
Primary Request index.htm
cn.skyswordone.com/cgi-etc/vip/mtbnemail/
Redirect Chain
  • http://cn.skyswordone.com/cdn-cgi/phish-bypass?atok=XkkWxuhO1vrKcLFK2m6UKVowU6QwcEqmlvelugAtlTM-1662809596-0-%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm
  • http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
19 KB
8 KB
Document
General
Full URL
http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
Protocol
HTTP/1.1
Server
2606:4700:3030::6815:48cd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
11ef7e143c07d15502ff5e6f5d84f0af9dcbe1595213e0404d0713cd1d4ea581

Request headers

Referer
http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

CF-Cache-Status
DYNAMIC
CF-RAY
7487d920ea21baa5-MXP
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Sat, 10 Sep 2022 11:33:20 GMT
Last-Modified
Wed, 05 Jan 2022 13:48:30 GMT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yxCJG9zt0H8MZ4EBF6BotwxlenIMZIdluRSLQU%2FONgrwLNn7qrRjZo3MRBo8m6uPkS2YHCdVRF%2Fh6%2FVDk32uT3nilo8A5BgXE6Unt19oM3PQXAu7b6FiOMN04Y59BF2ElHtktSSTyCPllR%2FRtLbsAng%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

CF-RAY
7487d920c9b0baa5-MXP
Cache-Control
private, no-cache
Connection
keep-alive
Content-Length
167
Content-Type
text/html
Date
Sat, 10 Sep 2022 11:33:20 GMT
Location
http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
Server
cloudflare
X-Content-Type-Options
nosniff
X-Frame-Options
DENY
0856addebbab2000dfa6028493e9bcbd2cddaf5aeb4bd4a69e063ffb0634d3c91e8e341b47d8de5d
onlinebanking.mtb.com/TSPD/
0
0

0856addebbab200066aa00a9376f7a6c10c97aa7e1841d6d10eb7184b8a7474ff8ac49a8eac1c54c
onlinebanking.mtb.com/TSPD/
0
0

mtb_app_wbk.js
onlinebanking.mtb.com/Assets/js/
291 KB
170 KB
Script
General
Full URL
https://onlinebanking.mtb.com/Assets/js/mtb_app_wbk.js
Requested by
Host: cn.skyswordone.com
URL: http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
24.75.29.69 , United States, ASN16490 (MTB, US),
Reverse DNS
Software
/
Resource Hash
d3ef2f5f066d5e95eddaa211dd46621be15d0b6134d4cae115e0f5f72ac1efe9

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 10 Sep 2022 11:33:21 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
Content-Type
application/javascript; charset=UTF-8
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
X-Ion-Hop
1
Expires
0
css.mtb
resources.mtb.com/r/simple-layout-responsive/
253 KB
35 KB
Stylesheet
General
Full URL
https://resources.mtb.com/r/simple-layout-responsive/css.mtb?v=09242021103000
Requested by
Host: cn.skyswordone.com
URL: http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
24.75.29.77 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software
/
Resource Hash
79feb75fef9778bdc2fe775ed5e1aad4308c2312ecec0825409c161b6e5f2903
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Cteonnt-Length
258715
Date
Sat, 10 Sep 2022 11:33:20 GMT
Content-Encoding
gzip
Last-Modified
Sat, 10 Sep 2022 11:33:20 GMT
X-Srv
B-SC-01
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
ETag
"1662809601:dtagent10247220811100421ZWhG"
Vary
User-Agent
Content-Type
text/css; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
private
Transfer-Encoding
chunked
Server-Timing
dtSInfo;desc="0", dtRpid;desc="-199914046"
Expires
Sun, 10 Sep 2023 11:33:21 GMT
ruxitagentjs_ICA2Vfhjqrux_10227211018092056.js
onlinebanking.mtb.com/
223 KB
85 KB
Script
General
Full URL
https://onlinebanking.mtb.com/ruxitagentjs_ICA2Vfhjqrux_10227211018092056.js
Requested by
Host: cn.skyswordone.com
URL: http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
24.75.29.69 , United States, ASN16490 (MTB, US),
Reverse DNS
Software
/
Resource Hash
a304d13035a3691fd9586497a6d7cee7f7f0923a30a49f4a24973bd2362bb27f
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 11:33:19 GMT
Content-Encoding
gzip
X-SRV
B-WEB-06
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
P3P
CP='CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT'
Cache-Control
public, max-age=3600
Content-Type
text/javascript; charset=utf-8
Content-Length
86087
Expires
Sat, 10 Sep 2022 12:33:19 GMT
tealium_prod.js
onlinebanking.mtb.com/Assets/js/
307 B
2 KB
Script
General
Full URL
https://onlinebanking.mtb.com/Assets/js/tealium_prod.js
Requested by
Host: cn.skyswordone.com
URL: http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
24.75.29.69 , United States, ASN16490 (MTB, US),
Reverse DNS
Software
/
Resource Hash
bcc41de3276fb2e7cf0be64b6a62e5306e18efbf14efa5379c1d89acad6ffc2a
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 11:33:19 GMT
Last-Modified
Sat, 10 Sep 2022 04:51:56 GMT
X-SRV
B-WEB-06
ETag
"0be6edd1c4d81:0"
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
P3P
CP='CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT'
Cache-Control
max-age=1800
Server-Timing
dtSInfo;desc="0", dtRpid;desc="-1603110458"
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
307
mtb-logo.svg
resources.mtb.com/Assets/img/
2 KB
3 KB
Image
General
Full URL
https://resources.mtb.com/Assets/img/mtb-logo.svg
Requested by
Host: cn.skyswordone.com
URL: http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
24.75.29.77 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software
/
Resource Hash
5f5b0d9f678fe446631a33a4cbbe891a01b0ed972143702e67ae6617367096ac
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 11:33:21 GMT
Last-Modified
Sat, 10 Sep 2022 04:24:34 GMT
X-Srv
B-SC-01
ETag
"06db93acdc4d81:0"
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Server-Timing
dtSInfo;desc="0", dtRpid;desc="508960007"
Accept-Ranges
bytes
Content-Length
2039
mtb-equalhousinglender.svg
resources.mtb.com/Assets/img/
230 B
810 B
Image
General
Full URL
https://resources.mtb.com/Assets/img/mtb-equalhousinglender.svg
Requested by
Host: cn.skyswordone.com
URL: http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
24.75.29.77 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software
/
Resource Hash
d58eb2802f72d0c6b1d944a1335e8fb914af44b51fe16097aad994c15b8cfbad
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 11:33:21 GMT
Last-Modified
Sat, 10 Sep 2022 04:24:34 GMT
X-Srv
B-SC-01
ETag
"06db93acdc4d81:0"
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Server-Timing
dtSInfo;desc="0", dtRpid;desc="506357607"
Accept-Ranges
bytes
Content-Length
230
mtb-entrust.svg
resources.mtb.com/Assets/img/
1 KB
2 KB
Image
General
Full URL
https://resources.mtb.com/Assets/img/mtb-entrust.svg
Requested by
Host: cn.skyswordone.com
URL: http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
24.75.29.77 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software
/
Resource Hash
b2ef3bd17aa6bc2daa7b1209f7848b30c64f3068e43162b09a216639ab430ce5
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 11:33:21 GMT
Last-Modified
Sat, 10 Sep 2022 04:24:34 GMT
X-Srv
B-SC-01
ETag
"06db93acdc4d81:0"
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Server-Timing
dtSInfo;desc="0", dtRpid;desc="1890006633"
Accept-Ranges
bytes
Content-Length
1349
js.mtb
resources.mtb.com/r/simple-layout-responsive/
315 KB
103 KB
Script
General
Full URL
https://resources.mtb.com/r/simple-layout-responsive/js.mtb?v=09242021103000
Requested by
Host: cn.skyswordone.com
URL: http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
24.75.29.77 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software
/
Resource Hash
6ef98ef294d03000d904d5f868598dc98667a0d00338cee40b3080a9d725d1cd
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 11:33:20 GMT
Content-Encoding
gzip
Last-Modified
Sat, 10 Sep 2022 11:33:20 GMT
X-Srv
B-SC-01
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
ETag
"1662809601:dtagent10247220811100421ZWhG"
ntCoent-Length
322405
Vary
User-Agent
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
private
Transfer-Encoding
chunked
Server-Timing
dtSInfo;desc="0", dtRpid;desc="-861262174"
Expires
Sun, 10 Sep 2023 11:33:21 GMT
Index.js
onlinebanking.mtb.com/Assets/scripts/Login/
7 KB
8 KB
Script
General
Full URL
https://onlinebanking.mtb.com/Assets/scripts/Login/Index.js
Requested by
Host: cn.skyswordone.com
URL: http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
24.75.29.69 , United States, ASN16490 (MTB, US),
Reverse DNS
Software
/
Resource Hash
652e3c2929e037e2128c18a5f5072906b88cb848295c3611af49df2c41ed70a5
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 11:33:19 GMT
Last-Modified
Sat, 10 Sep 2022 04:51:56 GMT
X-SRV
B-WEB-06
ETag
"0be6edd1c4d81:0"
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
P3P
CP='CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT'
Cache-Control
max-age=1800
Server-Timing
dtSInfo;desc="0", dtRpid;desc="1729833343"
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
6950
1
ponos.zeronaught.com/
921 B
1 KB
XHR
General
Full URL
https://ponos.zeronaught.com/1?a=2bf6dbb2864396b97f1160826d33cb1158d36fce&b=Ax71LCeDAQAAeJG8joglo3pcgfKznP7ju7c2Kzi1AHANpklAFr97tSvOnAM7AdlAlwiucjv8wH8AAEB3AAAAAA==&c=105922254
Requested by
Host: onlinebanking.mtb.com
URL: https://onlinebanking.mtb.com/Assets/js/mtb_app_wbk.js
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
107.162.179.174 , United States, ASN55002 (DEFENSE-NET, US),
Reverse DNS
Software
/
Resource Hash
233523573e40045b11d30cb29f6a162ac2fbc3fee9f731e3e70b2d473206d0a2

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Connection
close
Content-Length
921
Content-Type
text/plain; charset=UTF-8
utag.js
tags.tiqcdn.com/utag/mtbank/olb-legacy/prod/
92 KB
31 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/mtbank/olb-legacy/prod/utag.js
Requested by
Host: onlinebanking.mtb.com
URL: https://onlinebanking.mtb.com/Assets/js/tealium_prod.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5818710c7a273624585c9dbae0f67abd538e5d7e735dc883d1a61504cd9b7b6b

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 11:33:22 GMT
content-encoding
gzip
last-modified
Mon, 05 Sep 2022 17:38:10 GMT
server
AkamaiNetStorage
etag
"08aaeaaa082a669073629ac4215d0f2e:1662399490.636696"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=300
accept-ranges
bytes
content-length
31743
expires
Sat, 10 Sep 2022 11:38:22 GMT
mandtbaltoweb-book.woff
resources.mtb.com/assets/fonts/
66 KB
67 KB
Font
General
Full URL
https://resources.mtb.com/assets/fonts/mandtbaltoweb-book.woff
Requested by
Host: resources.mtb.com
URL: https://resources.mtb.com/r/simple-layout-responsive/css.mtb?v=09242021103000
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
24.75.29.77 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software
/
Resource Hash
4029a5a081992259f4e529190b49dbba893931da4e843dd203449f1b9a4509d2
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

Referer
https://resources.mtb.com/r/simple-layout-responsive/css.mtb?v=09242021103000
Origin
http://cn.skyswordone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 11:33:21 GMT
Last-Modified
Sat, 10 Sep 2022 04:24:33 GMT
X-Srv
B-SC-01
ETag
"06db93acdc4d81:0:dtagent10247220811100421ZWhG"
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
Content-Type
APPLICATION/X-WOFF
Access-Control-Allow-Origin
*
Server-Timing
dtSInfo;desc="0", dtRpid;desc="-1903783408"
Accept-Ranges
bytes
Content-Length
67671
mandtpg-iconfont.woff
resources.mtb.com/assets/fonts/
5 KB
5 KB
Font
General
Full URL
https://resources.mtb.com/assets/fonts/mandtpg-iconfont.woff
Requested by
Host: resources.mtb.com
URL: https://resources.mtb.com/r/simple-layout-responsive/css.mtb?v=09242021103000
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
24.75.29.77 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software
/
Resource Hash
108d16421ae2ff7fc5157d507dc5b1bf7f62140ba58cf3c723b1f2b7e74c21df
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

Referer
https://resources.mtb.com/r/simple-layout-responsive/css.mtb?v=09242021103000
Origin
http://cn.skyswordone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 11:33:21 GMT
Last-Modified
Sat, 10 Sep 2022 04:24:33 GMT
X-Srv
B-SC-01
ETag
"06db93acdc4d81:0:dtagent10247220811100421ZWhG"
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
Content-Type
APPLICATION/X-WOFF
Access-Control-Allow-Origin
*
Server-Timing
dtSInfo;desc="0", dtRpid;desc="353021237"
Accept-Ranges
bytes
Content-Length
4776
mandtbaltoweb-medium.woff
resources.mtb.com/assets/fonts/
63 KB
63 KB
Font
General
Full URL
https://resources.mtb.com/assets/fonts/mandtbaltoweb-medium.woff
Requested by
Host: resources.mtb.com
URL: https://resources.mtb.com/r/simple-layout-responsive/css.mtb?v=09242021103000
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
24.75.29.77 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software
/
Resource Hash
b391b55f950528937beee7687717a4aef81196817834f1c93b099713ff738fbc
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

Referer
https://resources.mtb.com/r/simple-layout-responsive/css.mtb?v=09242021103000
Origin
http://cn.skyswordone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 11:33:21 GMT
Last-Modified
Sat, 10 Sep 2022 04:24:33 GMT
X-Srv
B-SC-01
ETag
"06db93acdc4d81:0:dtagent10247220811100421ZWhG"
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
Content-Type
APPLICATION/X-WOFF
Access-Control-Allow-Origin
*
Server-Timing
dtSInfo;desc="0", dtRpid;desc="-83274152"
Accept-Ranges
bytes
Content-Length
64318
73d4227d-9d1c-4a1c-a439-be16d6b2493f
http://cn.skyswordone.com/
2 KB
0
Other
General
Full URL
blob:http://cn.skyswordone.com/73d4227d-9d1c-4a1c-a439-be16d6b2493f
Requested by
Host: cn.skyswordone.com
URL: http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1eec5d0bc72fba33ce753f6009a277e07041fb92d221ae5839bbc5e8fff1d0bb

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Length
2479
Content-Type
text/javascript
truncated
/
89 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
50e6072d26098d48004a30addeecabd5b22b91e5ccdf9dd86f96459783e3ac23

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type
image/png
quantum-mtb.js
cdn.quantummetric.com/qscripts/
Redirect Chain
  • http://cdn.quantummetric.com/qscripts/quantum-mtb.js
  • https://cdn.quantummetric.com/qscripts/quantum-mtb.js
245 KB
75 KB
Script
General
Full URL
https://cdn.quantummetric.com/qscripts/quantum-mtb.js
Requested by
Host: cn.skyswordone.com
URL: http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
Protocol
H2
Server
2606:4700:10::ac43:149e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
447caa692fed4da1e9fda5abcb60733b53fa6e6ed450990b8d9b3972483accaf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 11:33:23 GMT
content-encoding
br
cf-cache-status
EXPIRED
server
cloudflare
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
etag
W/"166273937452716613605351101662796802514"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=300, stale-while-revalidate=21600, stale-if-error=21600
strict-transport-security
max-age=31536000
cf-ray
7487d9325b220215-ZRH
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

Date
Sat, 10 Sep 2022 11:33:22 GMT
CF-Cache-Status
MISS
Server
cloudflare
Vary
Accept-Encoding
Content-Type
text/html
Location
https://cdn.quantummetric.com/qscripts/quantum-mtb.js
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
7487d9306f600200-ZRH
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
utag.8.js
tags.tiqcdn.com/utag/mtbank/olb-legacy/prod/
11 KB
4 KB
Script
General
Full URL
http://tags.tiqcdn.com/utag/mtbank/olb-legacy/prod/utag.8.js?utv=ut4.48.202111012113
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/mtbank/olb-legacy/prod/utag.js
Protocol
HTTP/1.1
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
651c517ff5f016be06ef6497924c898fdbe4dac5a612ae65c407c60e64c8f8b8

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 11:33:22 GMT
Content-Encoding
gzip
Last-Modified
Mon, 01 Nov 2021 21:13:28 GMT
Server
AkamaiNetStorage
ETag
"55e2dafd4e2f01e1da100818637f6e46:1635801208.490581"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=1296000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3522
Expires
Sun, 25 Sep 2022 11:33:22 GMT
s38600436800397
mtb.d1.sc.omtrdc.net/b/ss/mtb/1/JS-2.9.0/
Redirect Chain
  • http://mtb.d1.sc.omtrdc.net/b/ss/mtb/1/JS-2.9.0/s38600436800397?AQB=1&ndh=1&pf=1&t=10%2F8%2F2022%2011%3A33%3A22%206%200&fid=66C54E7516A63C47-3DBE5B1F0EFFF476&ce=UTF-8&pageName=OLB%3ALogin%3AIndex&g...
  • http://mtb.d1.sc.omtrdc.net/b/ss/mtb/1/JS-2.9.0/s38600436800397?AQB=1&pccr=true&ndh=1&pf=1&t=10%2F8%2F2022%2011%3A33%3A22%206%200&fid=66C54E7516A63C47-3DBE5B1F0EFFF476&ce=UTF-8&pageName=OLB%3ALogin...
43 B
703 B
Image
General
Full URL
http://mtb.d1.sc.omtrdc.net/b/ss/mtb/1/JS-2.9.0/s38600436800397?AQB=1&pccr=true&ndh=1&pf=1&t=10%2F8%2F2022%2011%3A33%3A22%206%200&fid=66C54E7516A63C47-3DBE5B1F0EFFF476&ce=UTF-8&pageName=OLB%3ALogin%3AIndex&g=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&r=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&cc=USD&events=event21&c16=no%20value&c17=Saturday%3A7%3A30AM&v19=D%3Dc17&c20=D%3Dg&c21=1&v21=D%3Dg&c22=New&v22=1&c23=First%20Visit&v23=New&v24=First%20Visit&v26=stop&v27=D%3DpageName&c41=OLB&v41=OLB&v136=1662809602564&v151=Tealium&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
Requested by
Host: cn.skyswordone.com
URL: http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
Protocol
HTTP/1.1
Server
15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-15-188-95-229.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 11:33:22 GMT
x-content-type-options
nosniff
last-modified
Sun, 11 Sep 2022 11:33:22 GMT
server
jag
etag
3570856430940979200-4619761568500252841
vary
*
p3p
CP="This is not a P3P policy"
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
content-type
image/gif;charset=utf-8
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 09 Sep 2022 11:33:22 GMT

Redirect headers

pragma
no-cache
date
Sat, 10 Sep 2022 11:33:22 GMT
x-content-type-options
nosniff
last-modified
Sun, 11 Sep 2022 11:33:22 GMT
server
jag
access-control-allow-origin
*
vary
Origin
p3p
CP="This is not a P3P policy"
location
http://mtb.d1.sc.omtrdc.net/b/ss/mtb/1/JS-2.9.0/s38600436800397?AQB=1&pccr=true&ndh=1&pf=1&t=10%2F8%2F2022%2011%3A33%3A22%206%200&fid=66C54E7516A63C47-3DBE5B1F0EFFF476&ce=UTF-8&pageName=OLB%3ALogin%3AIndex&g=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&r=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&cc=USD&events=event21&c16=no%20value&c17=Saturday%3A7%3A30AM&v19=D%3Dc17&c20=D%3Dg&c21=1&v21=D%3Dg&c22=New&v22=1&c23=First%20Visit&v23=New&v24=First%20Visit&v26=stop&v27=D%3DpageName&c41=OLB&v41=OLB&v136=1662809602564&v151=Tealium&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
cache-control
no-cache, no-store, max-age=0, no-transform, private
content-type
text/plain;charset=utf-8
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 09 Sep 2022 11:33:22 GMT
js
www.googletagmanager.com/gtag/
115 KB
46 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-990489911
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/mtbank/olb-legacy/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
0d9208cda1a86011a94223e216f69a8daaee010b5ab633240b0fd7228d9a9923
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 11:33:22 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
46195
x-xss-protection
0
last-modified
Sat, 10 Sep 2022 09:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 10 Sep 2022 11:33:22 GMT
utag.v.js
tags.tiqcdn.com/utag/tiqapp/
2 B
375 B
Script
General
Full URL
http://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=mtbank/olb-legacy/202209051738&cb=1662809602605
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/mtbank/olb-legacy/prod/utag.js
Protocol
HTTP/1.1
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Unused62
8096267
Date
Sat, 10 Sep 2022 11:33:22 GMT
Last-Modified
Thu, 14 Apr 2016 16:57:51 GMT
Server
AkamaiNetStorage
ETag
"7bc0ee636b3b83484fc3b9348863bd22:1460653071"
Content-Type
application/x-javascript
Cache-Control
max-age=600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2
Expires
Sat, 10 Sep 2022 11:43:22 GMT
conversion_async.js
www.googleadservices.com/pagead/
41 KB
16 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-990489911
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
cafe /
Resource Hash
f6200e00f9bcf9a324c8c1a046c6bc624ebcaf1379faf13e4d76ae56ea0d1a11
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 11:33:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15690
x-xss-protection
0
server
cafe
etag
13194339052015637803
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Sat, 10 Sep 2022 11:33:22 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/990489911/
2 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/990489911/?random=1662809602896&cv=9&fst=1662809602896&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&ref=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&tiba=Welcome%20to%20Online%20Banking%20%7C%20M%26T%20Bank&auid=1321078356.1662809603&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
87590965c0757df9dde9f7f9077fb90cb11a366be6b13637bee96e45aa96b4c8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 11:33:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1084
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/990489911/
42 B
548 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/990489911/?random=1662809602896&cv=9&fst=1662807600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&ref=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&tiba=Welcome%20to%20Online%20Banking%20%7C%20M%26T%20Bank&async=1&fmt=3&is_vtc=1&random=3423216156&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: cn.skyswordone.com
URL: http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 11:33:23 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/990489911/
42 B
548 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/990489911/?random=1662809602896&cv=9&fst=1662807600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&ref=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&tiba=Welcome%20to%20Online%20Banking%20%7C%20M%26T%20Bank&async=1&fmt=3&is_vtc=1&random=3423216156&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: cn.skyswordone.com
URL: http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 11:33:23 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ac676e6b-4412-4db1-92b9-1e4aa9dd3bf7
http://cn.skyswordone.com/
17 KB
0
Other
General
Full URL
blob:http://cn.skyswordone.com/ac676e6b-4412-4db1-92b9-1e4aa9dd3bf7
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dbe3697b071fd50671af8291f50429de1ff2e2df9dd5610caf887afcbbe0d51c

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Length
17224
Content-Type
application/javascript
/
mtb-app.quantummetric.com/ Frame A21B
90 B
911 B
XHR
General
Full URL
https://mtb-app.quantummetric.com/?T=B&u=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&t=1662809603809&v=1662809604263&z=1&S=0&N=0&P=0
Requested by
Host: cdn.quantummetric.com
URL: http://cdn.quantummetric.com/qscripts/quantum-mtb.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.67.142.127 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
127.142.67.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
4464b9c9266b5c89b6af56ded39a7cda8f379dbfbc24637ed9fac409b46f4ce3
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 10 Sep 2022 11:33:24 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
http://cn.skyswordone.com
access-control-allow-credentials
true
content-security-policy
default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
strict-transport-security
max-age=31536000; includeSubDomains;
x-robots-tag
noindex
/
mtb-app.quantummetric.com/ Frame A21B
0
647 B
XHR
General
Full URL
https://mtb-app.quantummetric.com/?T=B&u=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&t=1662809603809&v=1662809604265&z=1&Q=1&Y=1&X=67622c90a48e4bc078a3c4fa7feee343
Requested by
Host: cdn.quantummetric.com
URL: http://cdn.quantummetric.com/qscripts/quantum-mtb.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.67.142.127 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
127.142.67.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 10 Sep 2022 11:33:24 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains;
content-type
application/json
access-control-allow-origin
http://cn.skyswordone.com
access-control-allow-credentials
true
content-security-policy
default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
x-robots-tag
noindex
content-length
0
/
mtb-app.quantummetric.com/ Frame A21B
28 B
733 B
XHR
General
Full URL
https://mtb-app.quantummetric.com/?s=544c3e5ffe6c05374d6e6355fb2a3bc4&H=5924d007850a99a57bb7ae50&Q=3
Requested by
Host: cdn.quantummetric.com
URL: http://cdn.quantummetric.com/qscripts/quantum-mtb.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.67.142.127 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
127.142.67.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
12d77f615d7df0946899d769baa6094c8060d6006df35a1afb54c152b070871e
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 11:33:24 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
http://cn.skyswordone.com
access-control-allow-credentials
true
content-security-policy
default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
strict-transport-security
max-age=31536000; includeSubDomains;
x-robots-tag
noindex
rb_edeadee0-0165-4b9e-a91f-0085183ac4e1
cn.skyswordone.com/
226 B
879 B
XHR
General
Full URL
http://cn.skyswordone.com/rb_edeadee0-0165-4b9e-a91f-0085183ac4e1?type=js3&sn=v_4_srv_-2D58_sn_1DIARO9NI63IL0HL2UP7E4L4U274UALR&svrid=-58&flavor=post&vi=GBAGDICVKFSUPWROEVCAPKIJSKPPDUAD-0&modifiedSince=1636905497103&rf=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&bp=3&app=893c324bd7e5ac65&crc=2277239757&en=zgefxirc&end=1
Requested by
Host: onlinebanking.mtb.com
URL: https://onlinebanking.mtb.com/Assets/js/mtb_app_wbk.js
Protocol
HTTP/1.1
Server
2606:4700:3030::6815:48cd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
80a265bed528211aa708dcd58f7a95db36eeb7f873c6fe4ddab0b3a1dc0973a4

Request headers

Referer
http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Sat, 10 Sep 2022 11:33:24 GMT
CF-Cache-Status
DYNAMIC
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UL3KRjdPOGXzJIUpPHRf8SBCHFXUpxua%2FYbjZ9QpNOkt06RcFc9Ye4gixGOHwDAbKKuKhDQn4znx67FvXXxKFmwK0lnZDX40ab2y0ob%2Fx%2FfNXsbBtv9RSO6kdOFM0cVkLYMCHLbUPK32a%2FoBeiS4Sr8%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
text/html; charset=iso-8859-1
Connection
keep-alive
CF-RAY
7487d93e2b96baa5-MXP
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
/
mtb-app.quantummetric.com/ Frame A21B
0
647 B
XHR
General
Full URL
https://mtb-app.quantummetric.com/?T=B&u=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&t=1662809603809&v=1662809604815&H=5924d007850a99a57bb7ae50&s=544c3e5ffe6c05374d6e6355fb2a3bc4&U=9561ea5c63155bad5a1b901bf76c539f&z=1&Q=2&S=0&N=0
Requested by
Host: cdn.quantummetric.com
URL: http://cdn.quantummetric.com/qscripts/quantum-mtb.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.67.142.127 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
127.142.67.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 10 Sep 2022 11:33:24 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains;
content-type
application/json
access-control-allow-origin
http://cn.skyswordone.com
access-control-allow-credentials
true
content-security-policy
default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
x-robots-tag
noindex
content-length
0
/
mtb-app.quantummetric.com/ Frame A21B
0
647 B
XHR
General
Full URL
https://mtb-app.quantummetric.com/?T=B&u=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&t=1662809603809&v=1662809604943&H=5924d007850a99a57bb7ae50&s=544c3e5ffe6c05374d6e6355fb2a3bc4&z=1&S=693&N=2&P=1
Requested by
Host: cdn.quantummetric.com
URL: http://cdn.quantummetric.com/qscripts/quantum-mtb.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.67.142.127 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
127.142.67.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 10 Sep 2022 11:33:25 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains;
content-type
application/json
access-control-allow-origin
http://cn.skyswordone.com
access-control-allow-credentials
true
content-security-policy
default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
x-robots-tag
noindex
content-length
0
rb_edeadee0-0165-4b9e-a91f-0085183ac4e1
cn.skyswordone.com/
226 B
875 B
XHR
General
Full URL
http://cn.skyswordone.com/rb_edeadee0-0165-4b9e-a91f-0085183ac4e1?type=js3&sn=v_4_srv_-2D58_sn_1DIARO9NI63IL0HL2UP7E4L4U274UALR&svrid=-58&flavor=post&vi=GBAGDICVKFSUPWROEVCAPKIJSKPPDUAD-0&modifiedSince=1636905497103&rf=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&bp=3&app=893c324bd7e5ac65&crc=3729742064&en=zgefxirc&end=1
Requested by
Host: onlinebanking.mtb.com
URL: https://onlinebanking.mtb.com/Assets/js/mtb_app_wbk.js
Protocol
HTTP/1.1
Server
2606:4700:3030::6815:48cd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
80a265bed528211aa708dcd58f7a95db36eeb7f873c6fe4ddab0b3a1dc0973a4

Request headers

Referer
http://cn.skyswordone.com/cgi-etc/vip/mtbnemail/index.htm
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Sat, 10 Sep 2022 11:33:27 GMT
CF-Cache-Status
DYNAMIC
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0kgAUSUz2G06RHTPXpDklZWCqFsczs98222mHn7K3QEY3HsGtG2KMo%2FXpLFQ2CsGzNbCsXESs59JEVKf1haC0vW6n01G19k6PbLQTFlr%2BHoibLxL0zQDiMq1zKpeCnZEflWH68Cd2pHjyMlaZGL7ooo%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
text/html; charset=iso-8859-1
Connection
keep-alive
CF-RAY
7487d94ac853baa5-MXP
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
/
mtb-app.quantummetric.com/ Frame A21B
0
647 B
XHR
General
Full URL
https://mtb-app.quantummetric.com/?T=B&u=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&t=1662809603809&v=1662809609265&H=5924d007850a99a57bb7ae50&s=544c3e5ffe6c05374d6e6355fb2a3bc4&z=1&S=765&N=4&P=2
Requested by
Host: cdn.quantummetric.com
URL: http://cdn.quantummetric.com/qscripts/quantum-mtb.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.67.142.127 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
127.142.67.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 10 Sep 2022 11:33:29 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains;
content-type
application/json
access-control-allow-origin
http://cn.skyswordone.com
access-control-allow-credentials
true
content-security-policy
default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
x-robots-tag
noindex
content-length
0
/
mtb-app.quantummetric.com/ Frame A21B
0
647 B
XHR
General
Full URL
https://mtb-app.quantummetric.com/?T=B&u=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&t=1662809603809&v=1662809609392&H=5924d007850a99a57bb7ae50&s=544c3e5ffe6c05374d6e6355fb2a3bc4&z=1&Q=2&S=109&N=1
Requested by
Host: cdn.quantummetric.com
URL: http://cdn.quantummetric.com/qscripts/quantum-mtb.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.67.142.127 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
127.142.67.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 10 Sep 2022 11:33:29 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains;
content-type
application/json
access-control-allow-origin
http://cn.skyswordone.com
access-control-allow-credentials
true
content-security-policy
default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
x-robots-tag
noindex
content-length
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
onlinebanking.mtb.com
URL
https://onlinebanking.mtb.com/TSPD/0856addebbab2000dfa6028493e9bcbd2cddaf5aeb4bd4a69e063ffb0634d3c91e8e341b47d8de5d?type=9
Domain
onlinebanking.mtb.com
URL
https://onlinebanking.mtb.com/TSPD/0856addebbab200066aa00a9376f7a6c10c97aa7e1841d6d10eb7184b8a7474ff8ac49a8eac1c54c?type=17

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online) M&T Bank (Banking)

108 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| UIEvent object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation boolean| FzhL object| Is boolean| uWD object| _O object| dT_ object| dtrum string| APPID object| List object| s function| Hashtable function| startsWith function| DomDataCollection function| IE_FingerPrint function| Mozilla_FingerPrint function| Opera_FingerPrint function| Timer function| getRandomPort object| ProxyCollector function| BlackberryLocationCollector function| detectFields string| SEP string| PAIR string| DEV function| FingerPrint function| urlEncode function| encode_deviceprint function| decode_deviceprint function| post_deviceprint function| post_fingerprints function| add_deviceprint function| form_add_data function| form_add_deviceprint string| HTML5 string| BLACKBERRY string| UNDEFINED string| GEO_LOCATION_DEFAULT_STRUCT object| geoLocator boolean| geoLocatorStatus function| detectDeviceCollectionAPIMode function| init function| startCollection function| stopCollection function| getGeolocationStruct function| HTML5LocationCollector object| UIEventCollector function| InteractionElement function| UIElementList function| activeXDetect function| stripIllegalChars function| stripFullPath object| BrowserDetect function| convertTimestampToGMT function| getTimestampInMillis function| debug function| $ function| forceIE89Synchronicity boolean| utag_condload object| utag function| AppMeasurement function| s_gi function| s_pgicq function| AppMeasurement_Module_Integrate function| AppMeasurement_Module_ActivityMap boolean| __tealium_twc_switch object| s_c_il number| s_c_in number| s_objectID number| s_giq string| k object| dc object| fl object| cd number| utc object| tz number| thisy number| thish number| thismin number| thisd string| f0 string| targetRTFiredWithPV object| s_Obj string| s_PPVid function| s_PPVevent number| s_PPVi number| s_PPVt object| s_i_mtb string| gtagRename object| dataLayer function| gtag object| google_tag_manager object| google_tag_data function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO function| QuantumMetricInstrumentationStart object| QuantumMetricAPI number| QMAdminScriptErrorId function| qmflate function| _QuantumMetricSymbol

25 Cookies

Domain/Path Name / Value
.cn.skyswordone.com/ Name: __cf_mw_byp
Value: XkkWxuhO1vrKcLFK2m6UKVowU6QwcEqmlvelugAtlTM-1662809596-0-/cgi-etc/vip/mtbnemail/index.htm
.skyswordone.com/ Name: dtCookie
Value: v_4_srv_-2D58_sn_1DIARO9NI63IL0HL2UP7E4L4U274UALR
.skyswordone.com/ Name: rxVisitor
Value: 1662809602037QAB4FFBGMME0SF1T3UV1MKL3S71COOQH
.skyswordone.com/ Name: dtSa
Value: -
.skyswordone.com/ Name: utag_main
Value: v_id:0183272cf9f6001c8a7640bff0e803074003906c00b08$_sn:1$_se:1$_ss:1$_st:1662811402550$ses_id:1662809602550%3Bexp-session$_pn:1%3Bexp-session$vapi_domain:skyswordone.com
.skyswordone.com/ Name: sc_visit_start
Value: 1
.skyswordone.com/ Name: s_vnum
Value: 2094809602561%26vn%3D1
.skyswordone.com/ Name: s_invisit
Value: true
.skyswordone.com/ Name: s_dslv_s
Value: First%20Visit
.skyswordone.com/ Name: s_fid
Value: 66C54E7516A63C47-3DBE5B1F0EFFF476
.skyswordone.com/ Name: s_visitStart
Value: no%20value
.skyswordone.com/ Name: s_pv
Value: OLB%3ALogin%3AIndex
.skyswordone.com/ Name: s_nr
Value: 1662809602566-New
.skyswordone.com/ Name: s_dslv
Value: 1662809602566
.skyswordone.com/ Name: s_cc
Value: true
.skyswordone.com/ Name: _gcl_au
Value: 1.1.1321078356.1662809603
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.skyswordone.com/ Name: rxvt
Value: 1662811403704|1662809602038
.skyswordone.com/ Name: s_ppvl
Value: OLB%253ALogin%253AIndex%2C100%2C100%2C1200%2C1600%2C1200%2C1600%2C1200%2C1%2CP
.skyswordone.com/ Name: s_ppv
Value: OLB%253ALogin%253AIndex%2C100%2C100%2C1200%2C1600%2C1200%2C1600%2C1200%2C1%2CP
.skyswordone.com/ Name: dtPC
Value: -58$209602034_268h-vGBAGDICVKFSUPWROEVCAPKIJSKPPDUAD-0e0
mtb-app.quantummetric.com/ Name: s
Value: 544c3e5ffe6c05374d6e6355fb2a3bc4
mtb-app.quantummetric.com/ Name: U
Value: 9561ea5c63155bad5a1b901bf76c539f
.skyswordone.com/ Name: QuantumMetricSessionID
Value: 544c3e5ffe6c05374d6e6355fb2a3bc4
.skyswordone.com/ Name: QuantumMetricUserID
Value: 9561ea5c63155bad5a1b901bf76c539f

4 Console Messages

Source Level URL
Text
network error URL: https://onlinebanking.mtb.com/TSPD/0856addebbab2000dfa6028493e9bcbd2cddaf5aeb4bd4a69e063ffb0634d3c91e8e341b47d8de5d?type=9
Message:
Failed to load resource: net::ERR_CONNECTION_RESET
network error URL: https://onlinebanking.mtb.com/TSPD/0856addebbab200066aa00a9376f7a6c10c97aa7e1841d6d10eb7184b8a7474ff8ac49a8eac1c54c?type=17
Message:
Failed to load resource: net::ERR_CONNECTION_RESET
network error URL: http://cn.skyswordone.com/rb_edeadee0-0165-4b9e-a91f-0085183ac4e1?type=js3&sn=v_4_srv_-2D58_sn_1DIARO9NI63IL0HL2UP7E4L4U274UALR&svrid=-58&flavor=post&vi=GBAGDICVKFSUPWROEVCAPKIJSKPPDUAD-0&modifiedSince=1636905497103&rf=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&bp=3&app=893c324bd7e5ac65&crc=2277239757&en=zgefxirc&end=1
Message:
Failed to load resource: the server responded with a status of 406 (Not Acceptable)
network error URL: http://cn.skyswordone.com/rb_edeadee0-0165-4b9e-a91f-0085183ac4e1?type=js3&sn=v_4_srv_-2D58_sn_1DIARO9NI63IL0HL2UP7E4L4U274UALR&svrid=-58&flavor=post&vi=GBAGDICVKFSUPWROEVCAPKIJSKPPDUAD-0&modifiedSince=1636905497103&rf=http%3A%2F%2Fcn.skyswordone.com%2Fcgi-etc%2Fvip%2Fmtbnemail%2Findex.htm&bp=3&app=893c324bd7e5ac65&crc=3729742064&en=zgefxirc&end=1
Message:
Failed to load resource: the server responded with a status of 406 (Not Acceptable)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.quantummetric.com
cn.skyswordone.com
googleads.g.doubleclick.net
mtb-app.quantummetric.com
mtb.d1.sc.omtrdc.net
onlinebanking.mtb.com
ponos.zeronaught.com
resources.mtb.com
tags.tiqcdn.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
onlinebanking.mtb.com
104.75.88.194
107.162.179.174
15.188.95.229
216.58.212.130
24.75.29.69
24.75.29.77
2606:4700:10::ac43:149e
2606:4700:3030::6815:48cd
2a00:1450:4001:801::2002
2a00:1450:4001:80e::2003
2a00:1450:4001:810::2004
2a00:1450:4001:82b::2008
34.67.142.127
0d9208cda1a86011a94223e216f69a8daaee010b5ab633240b0fd7228d9a9923
108d16421ae2ff7fc5157d507dc5b1bf7f62140ba58cf3c723b1f2b7e74c21df
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b
11ef7e143c07d15502ff5e6f5d84f0af9dcbe1595213e0404d0713cd1d4ea581
12d77f615d7df0946899d769baa6094c8060d6006df35a1afb54c152b070871e
1eec5d0bc72fba33ce753f6009a277e07041fb92d221ae5839bbc5e8fff1d0bb
233523573e40045b11d30cb29f6a162ac2fbc3fee9f731e3e70b2d473206d0a2
4029a5a081992259f4e529190b49dbba893931da4e843dd203449f1b9a4509d2
4464b9c9266b5c89b6af56ded39a7cda8f379dbfbc24637ed9fac409b46f4ce3
447caa692fed4da1e9fda5abcb60733b53fa6e6ed450990b8d9b3972483accaf
4c68766dbc64c763b86ec0161dbadffe14c9614e6af96ccdddb9b09d4de09743
50e6072d26098d48004a30addeecabd5b22b91e5ccdf9dd86f96459783e3ac23
5818710c7a273624585c9dbae0f67abd538e5d7e735dc883d1a61504cd9b7b6b
5f5b0d9f678fe446631a33a4cbbe891a01b0ed972143702e67ae6617367096ac
651c517ff5f016be06ef6497924c898fdbe4dac5a612ae65c407c60e64c8f8b8
652e3c2929e037e2128c18a5f5072906b88cb848295c3611af49df2c41ed70a5
6ef98ef294d03000d904d5f868598dc98667a0d00338cee40b3080a9d725d1cd
79feb75fef9778bdc2fe775ed5e1aad4308c2312ecec0825409c161b6e5f2903
80a265bed528211aa708dcd58f7a95db36eeb7f873c6fe4ddab0b3a1dc0973a4
87590965c0757df9dde9f7f9077fb90cb11a366be6b13637bee96e45aa96b4c8
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a304d13035a3691fd9586497a6d7cee7f7f0923a30a49f4a24973bd2362bb27f
b2ef3bd17aa6bc2daa7b1209f7848b30c64f3068e43162b09a216639ab430ce5
b391b55f950528937beee7687717a4aef81196817834f1c93b099713ff738fbc
bcc41de3276fb2e7cf0be64b6a62e5306e18efbf14efa5379c1d89acad6ffc2a
d3ef2f5f066d5e95eddaa211dd46621be15d0b6134d4cae115e0f5f72ac1efe9
d58eb2802f72d0c6b1d944a1335e8fb914af44b51fe16097aad994c15b8cfbad
dbe3697b071fd50671af8291f50429de1ff2e2df9dd5610caf887afcbbe0d51c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f6200e00f9bcf9a324c8c1a046c6bc624ebcaf1379faf13e4d76ae56ea0d1a11