securmtbagnt.xyz Open in urlscan Pro
2606:4700:3030::ac43:cd7c Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://securmtbagnt.xyz/app/verify.php
Submission: On June 20 via api (June 20th 2023, 6:01:19 am UTC) from US — Scanned from US

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 11 HTTP transactions. The main IP is 2606:4700:3030::ac43:cd7c, located in United States and belongs to CLOUDFLARENET, US. The main domain is securmtbagnt.xyz.
TLS certificate: Issued by GTS CA 1P5 on June 5th 2023. Valid for: 3 months.

This is the only time securmtbagnt.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: M&T Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
10	2606:4700:303... 2606:4700:3030::ac43:cd7c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	108.138.85.96 108.138.85.96	16509 (AMAZON-02) (AMAZON-02)
11	2

10 2606:4700:3030::ac43:cd7c (United States)

ASN13335 (CLOUDFLARENET, US)

securmtbagnt.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.85.96 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-85-96.iad12.r.cloudfront.net

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	securmtbagnt.xyz securmtbagnt.xyz	228 KB
1	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 3081	449 B
11	2

	Domain	Requested by
10	securmtbagnt.xyz	securmtbagnt.xyz
1	nexus.ensighten.com	securmtbagnt.xyz
11	2

This site contains no links.

Subject Issuer	Validity	Valid
securmtbagnt.xyz GTS CA 1P5	`2023-06-05` - `2023-09-03`	3 months	crt.sh
nexus.ensighten.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-07` - `2023-10-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://securmtbagnt.xyz/app/verify.php
Frame ID: D7758EBB43501B8EE7F1F86558BF5214
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Verification | M&T Bank

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

229 kB
Transfer

621 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request verify.php Show response securmtbagnt.xyz/app/	9 KB 3 KB	265ms 182ms	Document text/html	2606:4700:3030::ac43:cd7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://securmtbagnt.xyz/app/verify.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:cd7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `12e4dcb3be374e3cacefbf8c22bdd7d74ed94abaef2c7a6159ced5b0e8aae872` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 accept-language en-US,en;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 7da1cb91f98fda93-MIA content-encoding br content-type text/html; charset=UTF-8 date Tue, 20 Jun 2023 06:01:05 GMT expires Thu, 19 Nov 1981 08:52:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X3YR55pqxYO1ZGZpqGU%2F8bDO9nXiF0PNmOzd6iJO%2Fm2i7wapCXhppyou9i6OTWHIkaf4%2FemT5EGt9y%2BEmYYn99NDqow2QwtubyWbxOnXDB9K1EtHWP3GYTaDhPa7OGZMDiENfIHSGvpZbRAH2O4X"}],"group":"cf-nel","max_age":604800} server cloudflare
GET H2	200	mtb.css securmtbagnt.xyz/libraries/css/	252 KB 30 KB	51ms 45ms	Stylesheet text/css	2606:4700:3030::ac43:cd7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://securmtbagnt.xyz/libraries/css/mtb.css Requested by Host: securmtbagnt.xyz URL: https://securmtbagnt.xyz/app/verify.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:cd7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d18b82a04723d0bdf0124a010cdc5c916fa42efd52309d49838255a483f35146` Request headers accept-language en-US,en;q=0.9 Referer https://securmtbagnt.xyz/app/verify.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Tue, 20 Jun 2023 06:01:05 GMT content-encoding br cf-cache-status HIT last-modified Sat, 13 Feb 2021 19:38:44 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 6463 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LXTJHkLF0D5s7YQmD7DT2HMlJWp580QBinj%2FYFSj9nTYv0tHfQc6cMf3b1ZnAT39PLZ43Kn71BPV4OoXRkH4ssAiFMcebIrn5a9i6kS6%2Fy3pxPE2vEqAFbeVLuvUD33TtA8CfX173MLqin1lQiU8"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 7da1cb932b22da93-MIA alt-svc h3=":443"; ma=86400
GET H2	200	Bootstrap.js Show response securmtbagnt.xyz/libraries/js/	52 KB 16 KB	45ms 40ms	Script application/javascript	2606:4700:3030::ac43:cd7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://securmtbagnt.xyz/libraries/js/Bootstrap.js Requested by Host: securmtbagnt.xyz URL: https://securmtbagnt.xyz/app/verify.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:cd7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b080e4b98b9a6a6a8a95a0034c7aa46fd054f5a67873912ff6107f934b7553f4` Request headers accept-language en-US,en;q=0.9 Referer https://securmtbagnt.xyz/app/verify.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Tue, 20 Jun 2023 06:01:05 GMT content-encoding br cf-cache-status HIT last-modified Sat, 13 Feb 2021 18:41:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 952 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NeYJk%2FdRpiHSKRnMfVm5ALYF8G1RnpoQ92N1Cqkv8ZHU1q1hP4U%2Fyp0b8YczxgFe0ir7vOaWNO0O94NA4CBC18mQUptFT4hzXTRYRlwrjRTANkPWLV3S%2F0jEUBIbHHwV6OK0z24HoWFyxSifRHnE"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 7da1cb932b24da93-MIA alt-svc h3=":443"; ma=86400
GET H2	200	mtb-logo.svg securmtbagnt.xyz/libraries/img/	2 KB 1 KB	168ms 164ms	Image image/svg+xml	2606:4700:3030::ac43:cd7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://securmtbagnt.xyz/libraries/img/mtb-logo.svg Requested by Host: securmtbagnt.xyz URL: https://securmtbagnt.xyz/app/verify.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:cd7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `5f5b0d9f678fe446631a33a4cbbe891a01b0ed972143702e67ae6617367096ac` Request headers accept-language en-US,en;q=0.9 Referer https://securmtbagnt.xyz/app/verify.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Tue, 20 Jun 2023 06:01:05 GMT content-encoding br cf-cache-status HIT last-modified Sat, 13 Feb 2021 18:41:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ylqsTdWxPohSCsmYsWrM3bDtH14MSGD%2B312d%2FzJZJpzhZpVQWcynH8mWTNXn6XQJIOAV0AyyOebveK4j3b%2FkObIHYZCKVhlGftifY5BWLp4IC1z%2FSCF%2BSFbrTq0PgeBp4ZihIjPvnrSzpFzmPKtN"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=14400 cf-ray 7da1cb932b28da93-MIA alt-svc h3=":443"; ma=86400
GET H2	200	mtb-equalhousinglender.svg securmtbagnt.xyz/libraries/img/	230 B 468 B	159ms 156ms	Image image/svg+xml	2606:4700:3030::ac43:cd7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://securmtbagnt.xyz/libraries/img/mtb-equalhousinglender.svg Requested by Host: securmtbagnt.xyz URL: https://securmtbagnt.xyz/app/verify.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:cd7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d58eb2802f72d0c6b1d944a1335e8fb914af44b51fe16097aad994c15b8cfbad` Request headers accept-language en-US,en;q=0.9 Referer https://securmtbagnt.xyz/app/verify.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Tue, 20 Jun 2023 06:01:05 GMT content-encoding br cf-cache-status HIT last-modified Sat, 13 Feb 2021 18:41:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DqUtjbNkzJeWqFeQyW7%2BdyWyVrcGyLYiFtNc%2FboDWtotDn3lUL4F6ROg4uvj1iAmj1sJ3jF85F7xLIeqshDSYMZlPLhxWoC2XhBXE8H%2BUSXPIRk4W%2F%2FXQg3%2B6jC6RkRbuifgozOy%2BPmQIRTKKZSN"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=14400 cf-ray 7da1cb932b29da93-MIA alt-svc h3=":443"; ma=86400
GET H2	200	mtb-entrust.svg securmtbagnt.xyz/libraries/img/	1 KB 1 KB	169ms 166ms	Image image/svg+xml	2606:4700:3030::ac43:cd7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://securmtbagnt.xyz/libraries/img/mtb-entrust.svg Requested by Host: securmtbagnt.xyz URL: https://securmtbagnt.xyz/app/verify.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:cd7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b2ef3bd17aa6bc2daa7b1209f7848b30c64f3068e43162b09a216639ab430ce5` Request headers accept-language en-US,en;q=0.9 Referer https://securmtbagnt.xyz/app/verify.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Tue, 20 Jun 2023 06:01:05 GMT content-encoding br cf-cache-status HIT last-modified Sat, 13 Feb 2021 18:41:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B7z%2Bfwz96ijI42F7S%2Bjsrkh22cxGjhaC0Yb4tIyzB92BBuEcQStQElj7KDR%2BNRgoJdsfvl%2BEIYcB5DzqJenSllwPwXiqNpqu7lXUELYgBlc%2B%2B9yHIsJa6xgmqDKGZi27NpCeBJcnnSkQyQHqPLmN"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=14400 cf-ray 7da1cb932b2ada93-MIA alt-svc h3=":443"; ma=86400
GET H2	200	jquery.min.js Show response securmtbagnt.xyz/libraries/	156 KB 41 KB	75ms 71ms	Script application/javascript	2606:4700:3030::ac43:cd7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://securmtbagnt.xyz/libraries/jquery.min.js Requested by Host: securmtbagnt.xyz URL: https://securmtbagnt.xyz/app/verify.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:cd7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `6e1297448cf350be58ab05a6c413fa4d4b97440a0a3ab97fb03c09ff49af5ad4` Request headers accept-language en-US,en;q=0.9 Referer https://securmtbagnt.xyz/app/verify.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Tue, 20 Jun 2023 06:01:05 GMT content-encoding br cf-cache-status HIT last-modified Sat, 02 May 2020 05:39:22 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 952 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iCSVXWMMBYqXRlkmea5%2B5P1dT1LqyKi0V%2F93cC2dm2WGxYaXP7p4WLA9ifuvOKGh369k1EDAmiJ5R45p5pMI8qrEor6SMcbyjEspG%2FHjBs61MkL0YsrCkwthYL5mcizyEQ0u"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 7da1cb932b26da93-MIA alt-svc h3=":443"; ma=86400
GET H2	200	jquery.mask.js Show response securmtbagnt.xyz/libraries/	20 KB 6 KB	48ms 44ms	Script application/javascript	2606:4700:3030::ac43:cd7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://securmtbagnt.xyz/libraries/jquery.mask.js Requested by Host: securmtbagnt.xyz URL: https://securmtbagnt.xyz/app/verify.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:cd7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44` Request headers accept-language en-US,en;q=0.9 Referer https://securmtbagnt.xyz/app/verify.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Tue, 20 Jun 2023 06:01:05 GMT content-encoding br cf-cache-status HIT last-modified Sun, 23 May 2021 20:29:22 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 952 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9W%2BGZ1WyG4RuLk9FHg%2BhtO7sBDm0zIdL2Apfa2f%2FWZfX6CSpxxbD035wd9fRFulrb6rvGDxaB1rIpHIFr%2FQbvwHN0J561%2B795hr9KRffOL%2FzPkSrs1OiORzPvYGk98nOj4hUMFGeDQALAWMxDf4G"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 7da1cb932b27da93-MIA alt-svc h3=":443"; ma=86400
GET H2	200	serverComponent.php Show response nexus.ensighten.com/mtbank/OE-Prod/	60 B 449 B	404ms 63ms	Script application/javascript	108.138.85.96 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/mtbank/OE-Prod/serverComponent.php?r=750516131.4857489&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/mtbank/OE-Prod/code/&publishedOn=Wed%20Feb%2003%2022:07:37%20GMT%202021&ClientID=1512&PageID=https%3A%2F%2Fsecurmtbagnt.xyz%2Fapp%2Fverify.php Requested by Host: securmtbagnt.xyz URL: https://securmtbagnt.xyz/libraries/js/Bootstrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.138.85.96 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-85-96.iad12.r.cloudfront.net Software CloudFront / Resource Hash `ad68c8c7e80948313b864c7f1f78556234fe7d5fc778337a7bf0db2efd0c7468` Request headers accept-language en-US,en;q=0.9 Referer https://securmtbagnt.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Tue, 20 Jun 2023 06:01:06 GMT via 1.1 afe53a1754be43c9b4c5c6fbf0780438.cloudfront.net (CloudFront) last-modified Thu, 08 Sep 2022 01:40:18 GMT server CloudFront x-amz-cf-pop IAD12-P2 etag "63194802-3c" x-cache Miss from cloudfront content-type application/javascript; charset=utf-8 cache-control no-cache, no-store accept-ranges bytes content-length 60 x-amz-cf-id -2V1ASbNYBAC2--z2YweLNGbIs1p8WS29XZJ62DC0rNBIWdSzNtrNQ== expires Tue, 20 Jun 2023 06:01:05 GMT
GET H3	200	mandtbaltoweb-book.woff securmtbagnt.xyz/libraries/fonts/	66 KB 67 KB	116ms 115ms	Font font/woff	2606:4700:3030::ac43:cd7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://securmtbagnt.xyz/libraries/fonts/mandtbaltoweb-book.woff Requested by Host: securmtbagnt.xyz URL: https://securmtbagnt.xyz/libraries/css/mtb.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::ac43:cd7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `4029a5a081992259f4e529190b49dbba893931da4e843dd203449f1b9a4509d2` Request headers Referer https://securmtbagnt.xyz/libraries/css/mtb.css Origin https://securmtbagnt.xyz accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Tue, 20 Jun 2023 06:01:05 GMT cf-cache-status HIT last-modified Sat, 13 Feb 2021 19:24:34 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 7 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KSrofhn40Niy4jmxrx42BW%2FMo2pczJTLvbEv4FU6Kbq89hUlnOg%2BpNAgjiqoqcvBShG2fREtIVKmIhLnu8TWT36Afj28IM%2B4i%2FxOK57ONABuktSq6lGupC2C7HzGAXOw3Nfb4LX6xaHW%2Fu3r2iKS"}],"group":"cf-nel","max_age":604800} content-type font/woff cache-control max-age=14400 accept-ranges bytes cf-ray 7da1cb942e8b6dc1-MIA alt-svc h3=":443"; ma=86400 content-length 67671
GET H3	200	mandtbaltoweb-medium.woff securmtbagnt.xyz/libraries/fonts/	63 KB 63 KB	39ms 38ms	Font font/woff	2606:4700:3030::ac43:cd7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://securmtbagnt.xyz/libraries/fonts/mandtbaltoweb-medium.woff Requested by Host: securmtbagnt.xyz URL: https://securmtbagnt.xyz/libraries/css/mtb.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::ac43:cd7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b391b55f950528937beee7687717a4aef81196817834f1c93b099713ff738fbc` Request headers Referer https://securmtbagnt.xyz/libraries/css/mtb.css Origin https://securmtbagnt.xyz accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Tue, 20 Jun 2023 06:01:05 GMT cf-cache-status HIT last-modified Sat, 13 Feb 2021 19:24:48 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 7 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7nUGbiHhRLSnfHLnqPzHJhu9UuRUnYHB1iPl5ov%2BqKAxuYnTlRANNGM3iWrV%2FdczQE457BsZuzuprTpTZO8l3%2B3IveF%2BY4gY2gLowBVNzuC6ZLzDsu4RXevBzoliTQXfLXy5rj7ZqdV%2F3K9ipnL3"}],"group":"cf-nel","max_age":604800} content-type font/woff cache-control max-age=14400 accept-ranges bytes cf-ray 7da1cb942e8c6dc1-MIA alt-svc h3=":443"; ma=86400 content-length 64318

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: M&T Bank (Banking)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			securmtbagnt.xyz/	1969-12-31 23:59:59	Name: PHPSESSID Value: 4426bf9166786ec70cc1ef7b14549483

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

nexus.ensighten.com
securmtbagnt.xyz
108.138.85.96
2606:4700:3030::ac43:cd7c
12e4dcb3be374e3cacefbf8c22bdd7d74ed94abaef2c7a6159ced5b0e8aae872
4029a5a081992259f4e529190b49dbba893931da4e843dd203449f1b9a4509d2
5f5b0d9f678fe446631a33a4cbbe891a01b0ed972143702e67ae6617367096ac
6e1297448cf350be58ab05a6c413fa4d4b97440a0a3ab97fb03c09ff49af5ad4
ad68c8c7e80948313b864c7f1f78556234fe7d5fc778337a7bf0db2efd0c7468
b080e4b98b9a6a6a8a95a0034c7aa46fd054f5a67873912ff6107f934b7553f4
b2ef3bd17aa6bc2daa7b1209f7848b30c64f3068e43162b09a216639ab430ce5
b391b55f950528937beee7687717a4aef81196817834f1c93b099713ff738fbc
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
d18b82a04723d0bdf0124a010cdc5c916fa42efd52309d49838255a483f35146
d58eb2802f72d0c6b1d944a1335e8fb914af44b51fe16097aad994c15b8cfbad

securmtbagnt.xyz Open in urlscan Pro 2606:4700:3030::ac43:cd7c Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

229 kBTransfer

621 kBSize

1 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

1 Cookies

Indicators

securmtbagnt.xyz Open in urlscan Pro
2606:4700:3030::ac43:cd7c Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

229 kB
Transfer

621 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!