urlscan.io logo urlscan.io
SecurityTrails logo

testcovid.life Open in urlscan Pro
192.0.78.149  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://testcovid.life/wp-content/themes/theme/mtb/login/
Submission: On January 05 via automatic, source phishtank — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 192.0.78.149, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is testcovid.life.
TLS certificate: Issued by R3 on November 17th 2022. Valid for: 3 months.
This is the only time testcovid.life was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: M&T Bank (Banking)

Domain & IP information

IP Address AS Autonomous System
8 192.0.78.149 2635 (AUTOMATTIC)
8 1
Apex Domain
Subdomains		 Transfer
8 testcovid.life
testcovid.life
37 KB
8 1
Domain Requested by
8 testcovid.life testcovid.life
8 1

This site contains no links.

Subject Issuer Validity Valid
tls.automattic.com
R3		 2022-11-17 -
2023-02-15		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://testcovid.life/wp-content/themes/theme/mtb/login/
Frame ID: 2BAA9CDC2B33FC34BD13BC1AB4EF9705
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Welcome to Online Banking | M&T Bank

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

37 kB
Transfer

322 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
testcovid.life/wp-content/themes/theme/mtb/login/ 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://testcovid.life/wp-content/themes/theme/mtb/login/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.149 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
2abed37ce156aa059603b69c2000cb000bdfc562fa9352ed2a1d05881dc00449
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
br
content-type
text/html; charset=utf-8
date
Thu, 05 Jan 2023 00:13:22 GMT
host-header
WordPress.com
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-ac
2.hhn _atomic_ams BYPASS
x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
css.css
testcovid.life/wp-content/themes/theme/mtb/login/files/ 		312 KB
33 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://testcovid.life/wp-content/themes/theme/mtb/login/files/css.css
Requested by
Host: testcovid.life
URL: https://testcovid.life/wp-content/themes/theme/mtb/login/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.149 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f74a25861ae21e1a4390700a3d86eb1887bdd87989b88be2c359ec2302bc00dc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://testcovid.life/wp-content/themes/theme/mtb/login/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Thu, 05 Jan 2023 00:13:22 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 04 Jan 2023 15:32:45 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63b59c1d-4e146"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=604800
expires
Thu, 12 Jan 2023 00:13:22 GMT
mtb-logo.svg
testcovid.life/wp-content/themes/theme/mtb/login/files/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://testcovid.life/wp-content/themes/theme/mtb/login/files/mtb-logo.svg
Requested by
Host: testcovid.life
URL: https://testcovid.life/wp-content/themes/theme/mtb/login/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.149 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
5f5b0d9f678fe446631a33a4cbbe891a01b0ed972143702e67ae6617367096ac
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://testcovid.life/wp-content/themes/theme/mtb/login/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Thu, 05 Jan 2023 00:13:22 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 04 Jan 2023 15:32:45 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63b59c1d-7f7"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=604800
expires
Thu, 12 Jan 2023 00:13:22 GMT
mtb-equalhousinglender.svg
testcovid.life/wp-content/themes/theme/mtb/login/files/ 		230 B
282 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://testcovid.life/wp-content/themes/theme/mtb/login/files/mtb-equalhousinglender.svg
Requested by
Host: testcovid.life
URL: https://testcovid.life/wp-content/themes/theme/mtb/login/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.149 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d58eb2802f72d0c6b1d944a1335e8fb914af44b51fe16097aad994c15b8cfbad
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://testcovid.life/wp-content/themes/theme/mtb/login/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Thu, 05 Jan 2023 00:13:22 GMT
strict-transport-security
max-age=31536000
x-ac
2.hhn _atomic_ams BYPASS
last-modified
Wed, 04 Jan 2023 15:32:45 GMT
server
nginx
etag
"63b59c1d-e6"
access-control-allow-methods
GET, HEAD
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=604800
accept-ranges
bytes
content-length
230
expires
Thu, 12 Jan 2023 00:13:22 GMT
mtb-entrust.svg
testcovid.life/wp-content/themes/theme/mtb/login/files/ 		1 KB
790 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://testcovid.life/wp-content/themes/theme/mtb/login/files/mtb-entrust.svg
Requested by
Host: testcovid.life
URL: https://testcovid.life/wp-content/themes/theme/mtb/login/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.149 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
b2ef3bd17aa6bc2daa7b1209f7848b30c64f3068e43162b09a216639ab430ce5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://testcovid.life/wp-content/themes/theme/mtb/login/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Thu, 05 Jan 2023 00:13:22 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 04 Jan 2023 15:32:45 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63b59c1d-545"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=604800
expires
Thu, 12 Jan 2023 00:13:22 GMT
mandtbaltoweb-book.woff
testcovid.life/wp-content/themes/theme/mtb/login/files/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://testcovid.life/wp-content/themes/theme/mtb/login/files/mandtbaltoweb-book.woff
Requested by
Host: testcovid.life
URL: https://testcovid.life/wp-content/themes/theme/mtb/login/files/css.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.149 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://testcovid.life/wp-content/themes/theme/mtb/login/files/css.css
Origin
https://testcovid.life
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Thu, 05 Jan 2023 00:13:22 GMT
strict-transport-security
max-age=31536000
content-encoding
br
x-ac
2.hhn _atomic_ams BYPASS
server
nginx
vary
Accept-Encoding, Origin
content-type
text/html; charset=UTF-8
access-control-allow-origin
https://testcovid.life
cache-control
no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
host-header
WordPress.com
link
<https://testcovid.life/wp-json/>; rel="https://api.w.org/"
expires
Wed, 11 Jan 1984 05:00:00 GMT
mandtpg-iconfont.woff
testcovid.life/wp-content/themes/theme/mtb/login/files/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://testcovid.life/wp-content/themes/theme/mtb/login/files/mandtpg-iconfont.woff
Requested by
Host: testcovid.life
URL: https://testcovid.life/wp-content/themes/theme/mtb/login/files/css.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.149 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://testcovid.life/wp-content/themes/theme/mtb/login/files/css.css
Origin
https://testcovid.life
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Thu, 05 Jan 2023 00:13:22 GMT
strict-transport-security
max-age=31536000
content-encoding
br
x-ac
2.hhn _atomic_ams BYPASS
server
nginx
vary
Accept-Encoding, Origin
content-type
text/html; charset=UTF-8
access-control-allow-origin
https://testcovid.life
cache-control
no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
host-header
WordPress.com
link
<https://testcovid.life/wp-json/>; rel="https://api.w.org/"
expires
Wed, 11 Jan 1984 05:00:00 GMT
mandtbaltoweb-medium.woff
testcovid.life/wp-content/themes/theme/mtb/login/files/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://testcovid.life/wp-content/themes/theme/mtb/login/files/mandtbaltoweb-medium.woff
Requested by
Host: testcovid.life
URL: https://testcovid.life/wp-content/themes/theme/mtb/login/files/css.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.149 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://testcovid.life/wp-content/themes/theme/mtb/login/files/css.css
Origin
https://testcovid.life
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Thu, 05 Jan 2023 00:13:22 GMT
strict-transport-security
max-age=31536000
content-encoding
br
x-ac
2.hhn _atomic_ams BYPASS
server
nginx
vary
Accept-Encoding, Origin
content-type
text/html; charset=UTF-8
access-control-allow-origin
https://testcovid.life
cache-control
no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
host-header
WordPress.com
link
<https://testcovid.life/wp-json/>; rel="https://api.w.org/"
expires
Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: M&T Bank (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange

0 Cookies

3 Console Messages

Source Level URL
Text
network error URL: https://testcovid.life/wp-content/themes/theme/mtb/login/files/mandtbaltoweb-medium.woff
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://testcovid.life/wp-content/themes/theme/mtb/login/files/mandtpg-iconfont.woff
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://testcovid.life/wp-content/themes/theme/mtb/login/files/mandtbaltoweb-book.woff
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000