mttblord.duckdns.org Open in urlscan Pro
159.138.0.134  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://mtb-index4.firebaseapp.com/ Page URL
2. https://mttblord.duckdns.org/bbtech/ginn/ Page URL
3. https://mttblord.duckdns.org/bbtech/ginn/ses/session_index Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response mtb-index4.firebaseapp.com/	221 B 473 B	165ms 73ms	Document text/html	2620:0:890::100 FASTLY
General Check archive.org Show headers Download Go to Full URL https://mtb-index4.firebaseapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:0:890::100 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 8c3ead84098d0808dfc5b355fa9bc816508c41bcb92c163854b26af8c20525a4 Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 cache-control max-age=3600 content-encoding br content-length 107 content-type text/html; charset=utf-8 date Sat, 09 Jul 2022 00:20:13 GMT etag "347ef024e336fa46e199871ceab5607aeeb054a52e7c437eed23faf66f9b80ba-br" last-modified Thu, 07 Jul 2022 22:49:38 GMT strict-transport-security max-age=31556926; includeSubDomains; preload vary x-fh-requested-host, accept-encoding x-cache MISS x-cache-hits 0 x-served-by cache-muc13958-MUC x-timer S1657326013.037922,VS0,VE40
GET H2	200	/ mttblord.duckdns.org/bbtech/ginn/	61 B 214 B	3796ms 3151ms	Document text/html	159.138.0.134
General Check archive.org Show headers Download Go to Full URL https://mttblord.duckdns.org/bbtech/ginn/ Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 159.138.0.134 -, , ASN (), Reverse DNS Software nginx / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15768000; Request headers Referer https://mtb-index4.firebaseapp.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding gzip content-length 72 content-type text/html; charset=UTF-8 date Sat, 09 Jul 2022 00:20:16 GMT server nginx strict-transport-security max-age=15768000; vary Accept-Encoding
GET H2	200	Primary Request session_index Show response mttblord.duckdns.org/bbtech/ginn/ses/	6 KB 2 KB	1409ms 1408ms	Document text/html	159.138.0.134
General Check archive.org Show headers Download Go to Full URL https://mttblord.duckdns.org/bbtech/ginn/ses/session_index Requested by Host: mttblord.duckdns.org URL: https://mttblord.duckdns.org/bbtech/ginn/ Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 159.138.0.134 -, , ASN (), Reverse DNS Software nginx / Resource Hash f59762b4c525e4633b49c4771261715ed5fb55eddafbbe3aaffc30c4927031de Security Headers Name Value Strict-Transport-Security max-age=15768000; Request headers Referer https://mttblord.duckdns.org/bbtech/ginn/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding gzip content-length 2142 content-type text/html; charset=UTF-8 date Sat, 09 Jul 2022 00:20:18 GMT server nginx strict-transport-security max-age=15768000; vary Accept-Encoding
GET H2	200	killbot-security.js Show response files.killbot.org/.cdn-cgi/	2 KB 2 KB	76ms 26ms	Script application/javascript	2606:4700:3030::6815:ba0
General Check archive.org Show headers Download Go to Full URL https://files.killbot.org/.cdn-cgi/killbot-security.js Requested by Host: mttblord.duckdns.org URL: https://mttblord.duckdns.org/bbtech/ginn/ses/session_index Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:ba0 -, , ASN (), Reverse DNS Software cloudflare / Killbot, Inc. Resource Hash 13f7de72970d9a3b94fcc44a294dc8159489be5195d477a95fa85a026b38242c Security Headers Name Value Content-Security-Policy default-src 'self' http: https: data: blob: 'unsafe-inline' 'unsafe-eval' Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://mttblord.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sat, 09 Jul 2022 00:20:18 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 780471 x-powered-by Killbot, Inc. cross-origin-resource-policy cross-origin vary Accept-Encoding x-xss-protection 1; mode=block last-modified Sat, 07 Aug 2021 14:01:31 GMT server cloudflare x-frame-options SAMEORIGIN etag W/"610e923b-960" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubdomains; preload report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7ukhMw9CiNHzfqjCiJX6Fh0J7CDXUvBF97tksY20tu1LHznkrE2Nflll2JsWdT0je8MBU%2FhJ3PZhksoatcCk1b1llGyOunoDYEgFQD6fQyaRIT7ESn%2FYl7VMzoIRq98X8DmB3x8bllRTm6MaWBoTWQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 expires Thu, 31 Dec 2037 23:55:55 GMT cache-control max-age=315360000 content-security-policy default-src 'self' http: https: data: blob: 'unsafe-inline' 'unsafe-eval' cf-ray 727ce49effe0bb79-FRA cf-bgj minify
GET H2	200	css.css mttblord.duckdns.org/bbtech/ginn/ses/files/	312 KB 32 KB	276ms 276ms	Stylesheet text/css	159.138.0.134
General Check archive.org Show headers Download Go to Full URL https://mttblord.duckdns.org/bbtech/ginn/ses/files/css.css Requested by Host: mttblord.duckdns.org URL: https://mttblord.duckdns.org/bbtech/ginn/ses/session_index Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 159.138.0.134 -, , ASN (), Reverse DNS Software nginx / Resource Hash f74a25861ae21e1a4390700a3d86eb1887bdd87989b88be2c359ec2302bc00dc Security Headers Name Value Strict-Transport-Security max-age=15768000; Request headers accept-language de-DE,de;q=0.9 Referer https://mttblord.duckdns.org/bbtech/ginn/ses/session_index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sat, 09 Jul 2022 00:20:18 GMT content-encoding gzip last-modified Thu, 10 Feb 2022 03:17:50 GMT server nginx etag W/"620483de-4e146" vary Accept-Encoding content-type text/css cache-control max-age=315360000 strict-transport-security max-age=15768000; expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	mtb-logo.svg mttblord.duckdns.org/bbtech/ginn/ses/files/	2 KB 1 KB	738ms 738ms	Image image/svg+xml	159.138.0.134
General Check archive.org Show headers Download Go to Show image Full URL https://mttblord.duckdns.org/bbtech/ginn/ses/files/mtb-logo.svg Requested by Host: mttblord.duckdns.org URL: https://mttblord.duckdns.org/bbtech/ginn/ses/session_index Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 159.138.0.134 -, , ASN (), Reverse DNS Software nginx / Resource Hash 5f5b0d9f678fe446631a33a4cbbe891a01b0ed972143702e67ae6617367096ac Security Headers Name Value Strict-Transport-Security max-age=15768000; Request headers accept-language de-DE,de;q=0.9 Referer https://mttblord.duckdns.org/bbtech/ginn/ses/session_index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sat, 09 Jul 2022 00:20:18 GMT content-encoding gzip last-modified Wed, 09 Feb 2022 02:28:20 GMT server nginx etag W/"620326c4-7f7" vary Accept-Encoding content-type image/svg+xml cache-control max-age=315360000 strict-transport-security max-age=15768000; expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	mtb-equalhousinglender.svg mttblord.duckdns.org/bbtech/ginn/ses/files/	230 B 442 B	737ms 737ms	Image image/svg+xml	159.138.0.134
General Check archive.org Show headers Download Go to Show image Full URL https://mttblord.duckdns.org/bbtech/ginn/ses/files/mtb-equalhousinglender.svg Requested by Host: mttblord.duckdns.org URL: https://mttblord.duckdns.org/bbtech/ginn/ses/session_index Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 159.138.0.134 -, , ASN (), Reverse DNS Software nginx / Resource Hash d58eb2802f72d0c6b1d944a1335e8fb914af44b51fe16097aad994c15b8cfbad Security Headers Name Value Strict-Transport-Security max-age=15768000; Request headers accept-language de-DE,de;q=0.9 Referer https://mttblord.duckdns.org/bbtech/ginn/ses/session_index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sat, 09 Jul 2022 00:20:18 GMT last-modified Wed, 09 Feb 2022 02:28:24 GMT server nginx etag "620326c8-e6" strict-transport-security max-age=15768000; content-type image/svg+xml cache-control max-age=315360000 accept-ranges bytes content-length 230 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	mtb-entrust.svg mttblord.duckdns.org/bbtech/ginn/ses/files/	1 KB 928 B	738ms 737ms	Image image/svg+xml	159.138.0.134
General Check archive.org Show headers Download Go to Show image Full URL https://mttblord.duckdns.org/bbtech/ginn/ses/files/mtb-entrust.svg Requested by Host: mttblord.duckdns.org URL: https://mttblord.duckdns.org/bbtech/ginn/ses/session_index Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 159.138.0.134 -, , ASN (), Reverse DNS Software nginx / Resource Hash b2ef3bd17aa6bc2daa7b1209f7848b30c64f3068e43162b09a216639ab430ce5 Security Headers Name Value Strict-Transport-Security max-age=15768000; Request headers accept-language de-DE,de;q=0.9 Referer https://mttblord.duckdns.org/bbtech/ginn/ses/session_index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sat, 09 Jul 2022 00:20:18 GMT content-encoding gzip last-modified Wed, 09 Feb 2022 02:28:26 GMT server nginx etag W/"620326ca-545" vary Accept-Encoding content-type image/svg+xml cache-control max-age=315360000 strict-transport-security max-age=15768000; expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	whois Show response killbot.org/api/v2/	275 B 1 KB	252ms 195ms	Fetch application/json	2606:4700:3030::6815:ba0
General Check archive.org Show headers Download Go to Full URL https://killbot.org/api/v2/whois?apikey=mkknJZVAELTx5CaSrP3T0BJ-JuOCmfGMVz-msAJtFmw-h Requested by Host: files.killbot.org URL: https://files.killbot.org/.cdn-cgi/killbot-security.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:ba0 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash 3ed5732bc2c55900fefd098c72bb395846d5912df581e35e7642ae153ad862d7 Request headers accept-language de-DE,de;q=0.9 Referer https://mttblord.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sat, 09 Jul 2022 00:20:18 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} access-control-allow-methods POST, GET alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 pragma no-cache server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 86400 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vt4WPRrrFMSA4ZHwTEpUqFWLoHuSvaLdmxpO9JLjefe%2FF8pcFIues2Bx5Ihub2maiRcwCSLXEAwhYnE2RlH90wuHy7lnajtxj5ScfqO5%2BtEvBF2Q7rkTDg%2BctcDxnbwS1noQKOUXisQh0w%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/json access-control-allow-origin * cache-control no-store, no-cache, must-revalidate access-control-allow-credentials true cf-ray 727ce49f78f7bbc1-FRA bug-bounty Report to live chat :) expires Thu, 19 Nov 1981 08:52:00 GMT
GET		blocker killbot.org/api/v2/	0 0
GET H2	200	mandtbaltoweb-book.woff mttblord.duckdns.org/bbtech/ginn/ses/files/	30 KB 0	270ms 269ms	Font font/woff	159.138.0.134
General Check archive.org Show headers Download Go to Full URL https://mttblord.duckdns.org/bbtech/ginn/ses/files/mandtbaltoweb-book.woff Requested by Host: mttblord.duckdns.org URL: https://mttblord.duckdns.org/bbtech/ginn/ses/files/css.css Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 159.138.0.134 -, , ASN (), Reverse DNS Software nginx / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15768000; Request headers Referer https://mttblord.duckdns.org/bbtech/ginn/ses/files/css.css Origin https://mttblord.duckdns.org accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sat, 09 Jul 2022 00:20:19 GMT last-modified Wed, 09 Feb 2022 02:28:36 GMT server nginx etag "620326d4-10857" strict-transport-security max-age=15768000; content-type font/woff cache-control max-age=315360000 accept-ranges bytes content-length 67671 expires Thu, 31 Dec 2037 23:55:55 GMT
GET		mandtpg-iconfont.woff mttblord.duckdns.org/bbtech/ginn/ses/files/	0 0
GET		mandtbaltoweb-medium.woff mttblord.duckdns.org/bbtech/ginn/ses/files/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

killbot.org

URL

https://killbot.org/api/v2/blocker?apikey=mkknJZVAELTx5CaSrP3T0BJ-JuOCmfGMVz-msAJtFmw-h&ip=2001:1b60:2:240:3247::11&ua=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/103.0.5060.53%20Safari/537.36&url=

Domain

mttblord.duckdns.org

URL

https://mttblord.duckdns.org/bbtech/ginn/ses/files/mandtpg-iconfont.woff

Domain

mttblord.duckdns.org

URL

https://mttblord.duckdns.org/bbtech/ginn/ses/files/mandtbaltoweb-medium.woff

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: M&T Bank (Banking)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

files.killbot.org
killbot.org
mtb-index4.firebaseapp.com
mttblord.duckdns.org
killbot.org
mttblord.duckdns.org
159.138.0.134
2606:4700:3030::6815:ba0
2620:0:890::100
13f7de72970d9a3b94fcc44a294dc8159489be5195d477a95fa85a026b38242c
3ed5732bc2c55900fefd098c72bb395846d5912df581e35e7642ae153ad862d7
5f5b0d9f678fe446631a33a4cbbe891a01b0ed972143702e67ae6617367096ac
8c3ead84098d0808dfc5b355fa9bc816508c41bcb92c163854b26af8c20525a4
b2ef3bd17aa6bc2daa7b1209f7848b30c64f3068e43162b09a216639ab430ce5
d58eb2802f72d0c6b1d944a1335e8fb914af44b51fe16097aad994c15b8cfbad
f59762b4c525e4633b49c4771261715ed5fb55eddafbbe3aaffc30c4927031de
f74a25861ae21e1a4390700a3d86eb1887bdd87989b88be2c359ec2302bc00dc