huntington-ir.com Open in urlscan Pro
216.226.155.194 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ir.tcfbank.com/
Effective URL:
http://huntington-ir.com/
Submission: On November 20 via api (November 20th 2022, 11:06:47 am UTC) from US — Scanned from DE

Summary HTTP 16 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 16 HTTP transactions. The main IP is 216.226.155.194, located in Columbus, United States and belongs to WOW-INTERNET, US. The main domain is huntington-ir.com.

This is the only time huntington-ir.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Huntington Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2.16.241.92 2.16.241.92	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
12	216.226.155.194 216.226.155.194	12083 (WOW-INTERNET) (WOW-INTERNET)
2	23.36.163.251 23.36.163.251	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a00:1450:400... 2a00:1450:4001:82b::200e	15169 (GOOGLE) (GOOGLE)
16	3

1 2.16.241.92 (Frankfurt am Main, Germany) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-241-92.deploy.static.akamaitechnologies.com

ir.tcfbank.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 216.226.155.194 (Columbus, United States)

ASN12083 (WOW-INTERNET, US)
PTR: mailsvr.investquest.com

huntington-ir.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.36.163.251 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-36-163-251.deploy.static.akamaitechnologies.com

www.huntington.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	huntington-ir.com huntington-ir.com	1 MB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 36	20 KB
2	huntington.com www.huntington.com — Cisco Umbrella Rank: 60541	2 KB
1	tcfbank.com 1 redirects ir.tcfbank.com	318 B
16	4

	Domain	Requested by
12	huntington-ir.com	huntington-ir.com
2	www.google-analytics.com	huntington-ir.com www.google-analytics.com
2	www.huntington.com	huntington-ir.com
1	ir.tcfbank.com	1 redirects
16	4

This site contains links to these domains. Also see Links.

Domain
huntington.com
www.huntington.com
www.nasdaq.com
www.investquest.com
careers.huntington.com
pages.huntington-email.com

Subject Issuer	Validity	Valid
huntington.com DigiCert SHA2 Extended Validation Server CA	`2022-05-10` - `2023-05-12`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://huntington-ir.com/
Frame ID: 8512EAABF218EF542A83CD4B51A6A147
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://ir.tcfbank.com/ HTTP 301
http://huntington-ir.com/ Page URL

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

16
Requests

19 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

1187 kB
Transfer

1214 kB
Size

4
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: http://huntington.com/
Title: Huntington.com

Search URL Search Domain Scan URL

URL: https://www.huntington.com/customer-service
Title: Customer Service

Search URL Search Domain Scan URL

URL: https://www.huntington.com/About-Us
Title: About Us

Search URL Search Domain Scan URL

URL: https://www.huntington.com/About-Us/company-information/board-of-directors
Title: Board of Directors

Search URL Search Domain Scan URL

URL: https://www.huntington.com/About-Us/company-information/executive-management-team/ExecutiveManagementTeam
Title: Corporate Officers

Search URL Search Domain Scan URL

URL: https://www.nasdaq.com/market-activity/stocks/hban/historical
Title: Historical Stock Prices

Search URL Search Domain Scan URL

URL: https://www.huntington.com/About-Us/more-about-huntington/corporate-governance
Title: Corporate Governance

Search URL Search Domain Scan URL

URL: http://www.investquest.com/iq/h/hban/main/Huntington_2021ESGReport_083122.pdf
Title: Environmental, Social and Governance Report

Search URL Search Domain Scan URL

URL: http://www.huntington.com/
Title: www.huntington.com

Search URL Search Domain Scan URL

URL: https://careers.huntington.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.huntington.com/sitemap
Title: Site Map

Search URL Search Domain Scan URL

URL: https://www.huntington.com/Privacy-Security
Title: Privacy & Security

Search URL Search Domain Scan URL

URL: https://pages.huntington-email.com/page.aspx?QS=c76003443ff9837d789f6f72fadb8d969a48c977aab19627
Title: Email Unsubscribe

Search URL Search Domain Scan URL

URL: https://www.huntington.com/fdicnotice/
Title: FDIC Notice

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ir.tcfbank.com/ HTTP 301
http://huntington-ir.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 12

http://www.google-analytics.com/analytics.js HTTP 307
https://www.google-analytics.com/analytics.js

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
huntington-ir.com/
Redirect Chain

http://ir.tcfbank.com/
http://huntington-ir.com/

54 KB
54 KB

347ms
116ms

Document
text/html

216.226.155.194
WOW-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: http://huntington-ir.com/
Protocol: HTTP/1.1
Server: 216.226.155.194 Columbus, United States, ASN12083 (WOW-INTERNET, US),
Reverse DNS: mailsvr.investquest.com
Software: Apache/2.0.52 (CentOS) /
Resource Hash: eeb3a59fa1b1f899472677b9c3536c3ea8cf31b3c115480b23221e66e003912d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: close
Content-Type: text/html; charset=UTF-8
Date: Sun, 20 Nov 2022 11:06:37 GMT
Server: Apache/2.0.52 (CentOS)
Transfer-Encoding: chunked

Redirect headers

Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 0
Date: Sun, 20 Nov 2022 11:06:37 GMT
Expires: Sun, 20 Nov 2022 11:06:37 GMT
Location: http://huntington-ir.com
Pragma: no-cache
Server-Timing: cdn-cache; desc=HIT edge; dur=1

GET
H/1.1 200
OK toolkit.css
huntington-ir.com/styles/ 124 KB
124 KB 232ms
116ms Stylesheet
text/css 216.226.155.194
WOW-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: http://huntington-ir.com/styles/toolkit.css
Requested by: Host: huntington-ir.com
URL: http://huntington-ir.com/
Protocol: HTTP/1.1
Server: 216.226.155.194 Columbus, United States, ASN12083 (WOW-INTERNET, US),
Reverse DNS: mailsvr.investquest.com
Software: Apache/2.0.52 (CentOS) /
Resource Hash: 8eda4f79f753bcec676f1e351880590e366ddf47dac4ced87e766ced8dd7146d

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://huntington-ir.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sun, 20 Nov 2022 11:06:37 GMT
Last-Modified: Thu, 02 Apr 2020 00:50:48 GMT
Server: Apache/2.0.52 (CentOS)
ETag: "524019-1eef8-310d8a00"
Content-Type: text/css
Connection: close
Accept-Ranges: bytes
Content-Length: 126712

GET
H/1.1 200
OK modernizr.js Show response
huntington-ir.com/scripts/ 21 KB
21 KB 232ms
116ms Script
application/x-javascript 216.226.155.194
WOW-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: http://huntington-ir.com/scripts/modernizr.js
Requested by: Host: huntington-ir.com
URL: http://huntington-ir.com/
Protocol: HTTP/1.1
Server: 216.226.155.194 Columbus, United States, ASN12083 (WOW-INTERNET, US),
Reverse DNS: mailsvr.investquest.com
Software: Apache/2.0.52 (CentOS) /
Resource Hash: cc0c10079662c9b244ede88022ef8316e7902d0789acedb11134c413bcbdb5d1

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://huntington-ir.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sun, 20 Nov 2022 11:06:37 GMT
Last-Modified: Fri, 06 Sep 2019 21:58:05 GMT
Server: Apache/2.0.52 (CentOS)
ETag: "220027-5432-8860b540"
Content-Type: application/x-javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 21554

GET
H/1.1 200
OK jquery-1.10.2.js Show response
huntington-ir.com/scripts/ 268 KB
268 KB 237ms
118ms Script
application/x-javascript 216.226.155.194
WOW-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: http://huntington-ir.com/scripts/jquery-1.10.2.js
Requested by: Host: huntington-ir.com
URL: http://huntington-ir.com/
Protocol: HTTP/1.1
Server: 216.226.155.194 Columbus, United States, ASN12083 (WOW-INTERNET, US),
Reverse DNS: mailsvr.investquest.com
Software: Apache/2.0.52 (CentOS) /
Resource Hash: 04139845ce14169e9b9cfad22c4a879dce68914b3875e71112b28bafbf96bf56

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://huntington-ir.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sun, 20 Nov 2022 11:06:37 GMT
Last-Modified: Fri, 06 Sep 2019 21:58:04 GMT
Server: Apache/2.0.52 (CentOS)
ETag: "220022-42e46-88517300"
Content-Type: application/x-javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 273990

GET
H/1.1 200
OK jquery.unobtrusive-ajax.js Show response
huntington-ir.com/scripts/ 6 KB
7 KB 237ms
119ms Script
application/x-javascript 216.226.155.194
WOW-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: http://huntington-ir.com/scripts/jquery.unobtrusive-ajax.js
Requested by: Host: huntington-ir.com
URL: http://huntington-ir.com/
Protocol: HTTP/1.1
Server: 216.226.155.194 Columbus, United States, ASN12083 (WOW-INTERNET, US),
Reverse DNS: mailsvr.investquest.com
Software: Apache/2.0.52 (CentOS) /
Resource Hash: c4fd6530994f6fed74c72a649f4938d2e2f97eb167c179314fc39b400c0aadb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://huntington-ir.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sun, 20 Nov 2022 11:06:37 GMT
Last-Modified: Fri, 06 Sep 2019 21:58:04 GMT
Server: Apache/2.0.52 (CentOS)
ETag: "220026-1919-88517300"
Content-Type: application/x-javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 6425

GET
H/1.1 200
OK H-Welcome_Logo_2019_GREEN_GRAY_RGB.png
huntington-ir.com/images/ 24 KB
24 KB 241ms
121ms Image
image/png 216.226.155.194
WOW-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://huntington-ir.com/images/H-Welcome_Logo_2019_GREEN_GRAY_RGB.png
Requested by: Host: huntington-ir.com
URL: http://huntington-ir.com/
Protocol: HTTP/1.1
Server: 216.226.155.194 Columbus, United States, ASN12083 (WOW-INTERNET, US),
Reverse DNS: mailsvr.investquest.com
Software: Apache/2.0.52 (CentOS) /
Resource Hash: 5de537351edba81c85245eac099b5eb3a7e59408f3eea0b8f18cda7eae600d65

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://huntington-ir.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sun, 20 Nov 2022 11:06:38 GMT
Last-Modified: Fri, 29 Oct 2021 15:31:53 GMT
Server: Apache/2.0.52 (CentOS)
ETag: "634051-5ecb-86ce0c40"
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 24267

GET
H2 200 lockup.svg
www.huntington.com/~/media/hcom/global/logo/ 4 KB
2 KB 262ms
57ms Image
image/svg+xml 23.36.163.251
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.huntington.com/~/media/hcom/global/logo/lockup.svg

Requested by

Host: huntington-ir.com
URL: http://huntington-ir.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.163.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-36-163-251.deploy.static.akamaitechnologies.com

Software

Resource Hash

38c973e72b29d0c5f054034abecb6f92d1f30fac5aeeb5d0300de1cce156ade3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://huntington-ir.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 20 Nov 2022 11:06:38 GMT
x-permitted-cross-domain-policies: master-only
p3p: CP="NON CUR OTPi OUR NOR UNI"
content-disposition: inline; filename="lockup.svg"
server-timing: dtSInfo;desc="0", dtRpid;desc="1126433901"
content-length: 1578
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 14 Jul 2020 14:26:49 GMT
etag: 25ac81b1cb8b4557ac63e0186de9a92b
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2205478
accept-ranges: bytes
expires: Thu, 15 Dec 2022 23:44:36 GMT

GET
H/1.1 200
OK document_open-sm.png
huntington-ir.com/img/ 30 KB
30 KB 243ms
119ms Image
image/png 216.226.155.194
WOW-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://huntington-ir.com/img/document_open-sm.png
Requested by: Host: huntington-ir.com
URL: http://huntington-ir.com/
Protocol: HTTP/1.1
Server: 216.226.155.194 Columbus, United States, ASN12083 (WOW-INTERNET, US),
Reverse DNS: mailsvr.investquest.com
Software: Apache/2.0.52 (CentOS) /
Resource Hash: 36cbc5b49d0e61aa818097c25690241285f19c79437ee559d8a6ce5764a307d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://huntington-ir.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sun, 20 Nov 2022 11:06:38 GMT
Last-Modified: Fri, 06 Sep 2019 21:54:37 GMT
Server: Apache/2.0.52 (CentOS)
ETag: "bb403b-76f8-7bfae140"
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 30456

GET
H/1.1 200
OK at-good-sm.png
huntington-ir.com/img/ 29 KB
30 KB 682ms
115ms Image
image/png 216.226.155.194
WOW-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://huntington-ir.com/img/at-good-sm.png
Requested by: Host: huntington-ir.com
URL: http://huntington-ir.com/
Protocol: HTTP/1.1
Server: 216.226.155.194 Columbus, United States, ASN12083 (WOW-INTERNET, US),
Reverse DNS: mailsvr.investquest.com
Software: Apache/2.0.52 (CentOS) /
Resource Hash: b626cacce5c3456c70aea87181809a5e8cf07936fc644080870637d42c38af8a

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://huntington-ir.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sun, 20 Nov 2022 11:06:39 GMT
Last-Modified: Fri, 06 Sep 2019 21:54:34 GMT
Server: Apache/2.0.52 (CentOS)
ETag: "bb4032-750f-7bcd1a80"
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 29967

GET
H2 200 minilogo.gif
www.huntington.com/-/media/hcom/global/logo/ 146 B
373 B 245ms
40ms Image
image/webp 23.36.163.251
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.huntington.com/-/media/hcom/global/logo/minilogo.gif?la=en
Requested by: Host: huntington-ir.com
URL: http://huntington-ir.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-251.deploy.static.akamaitechnologies.com
Software: Akamai Image Manager /
Resource Hash: b829e666e60ea0bd215c8688e67e7e810687358d6cfdf3d9d8f3bde12fb78d51

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://huntington-ir.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sun, 20 Nov 2022 11:06:38 GMT
last-modified: Wed, 08 Jun 2022 19:50:39 GMT
x-serial: 1946
server: Akamai Image Manager
x-check-cacheable: YES
etag: 6c4597a4afe84ad6a0b62cf522711d1e
content-type: image/webp
cache-control: private, no-transform, max-age=535100
content-length: 146
expires: Sat, 26 Nov 2022 15:44:58 GMT

GET
H/1.1 200
OK toolkit.js Show response
huntington-ir.com/scripts/ 490 KB
491 KB 242ms
119ms Script
application/x-javascript 216.226.155.194
WOW-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: http://huntington-ir.com/scripts/toolkit.js
Requested by: Host: huntington-ir.com
URL: http://huntington-ir.com/
Protocol: HTTP/1.1
Server: 216.226.155.194 Columbus, United States, ASN12083 (WOW-INTERNET, US),
Reverse DNS: mailsvr.investquest.com
Software: Apache/2.0.52 (CentOS) /
Resource Hash: f942a8005da6ee2aa0caa6bde29c49edb76317f75befa8c5f4308859b614c7f8

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://huntington-ir.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sun, 20 Nov 2022 11:06:38 GMT
Last-Modified: Fri, 06 Sep 2019 21:58:04 GMT
Server: Apache/2.0.52 (CentOS)
ETag: "220033-7a945-88517300"
Content-Type: application/x-javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 502085

GET
H/1.1 200
OK HuntingtonApexWeb-Medium.woff
huntington-ir.com/fonts/ 38 KB
38 KB 231ms
119ms Font
application/octet-stream 216.226.155.194
WOW-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: http://huntington-ir.com/fonts/HuntingtonApexWeb-Medium.woff
Requested by: Host: huntington-ir.com
URL: http://huntington-ir.com/styles/toolkit.css
Protocol: HTTP/1.1
Server: 216.226.155.194 Columbus, United States, ASN12083 (WOW-INTERNET, US),
Reverse DNS: mailsvr.investquest.com
Software: Apache/2.0.52 (CentOS) /
Resource Hash: 17e308faef5acc6838e7b3cf8673092abb4359d1c8d1d6a88d0e9c724d14eadf

Request headers

Referer: http://huntington-ir.com/styles/toolkit.css
Origin: http://huntington-ir.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sun, 20 Nov 2022 11:06:38 GMT
Last-Modified: Fri, 06 Sep 2019 21:54:24 GMT
Server: Apache/2.0.52 (CentOS)
ETag: "b3403a-961e-7b348400"
Content-Type: text/plain; charset=UTF-8
Connection: close
Accept-Ranges: bytes
Content-Length: 38430

GET
H/1.1 200
OK HuntingtonApexWeb-Bold.woff
huntington-ir.com/fonts/ 37 KB
37 KB 224ms
115ms Font
application/octet-stream 216.226.155.194
WOW-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: http://huntington-ir.com/fonts/HuntingtonApexWeb-Bold.woff
Requested by: Host: huntington-ir.com
URL: http://huntington-ir.com/styles/toolkit.css
Protocol: HTTP/1.1
Server: 216.226.155.194 Columbus, United States, ASN12083 (WOW-INTERNET, US),
Reverse DNS: mailsvr.investquest.com
Software: Apache/2.0.52 (CentOS) /
Resource Hash: d0fa57b694e54da5e499dd824c97cf63f0c6b50771912f048bc46d457367f86a

Request headers

Referer: http://huntington-ir.com/styles/toolkit.css
Origin: http://huntington-ir.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sun, 20 Nov 2022 11:06:38 GMT
Last-Modified: Fri, 06 Sep 2019 21:54:26 GMT
Server: Apache/2.0.52 (CentOS)
ETag: "b34022-949e-7b530880"
Content-Type: text/plain; charset=UTF-8
Connection: close
Accept-Ranges: bytes
Content-Length: 38046

GET
H2

200

analytics.js Show response
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/analytics.js
https://www.google-analytics.com/analytics.js

49 KB
20 KB

58ms
15ms

Script
text/javascript

2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: huntington-ir.com
URL: http://huntington-ir.com/

Protocol

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://huntington-ir.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 20 Nov 2022 09:15:54 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 6644
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20039
expires: Sun, 20 Nov 2022 11:15:54 GMT

Redirect headers

Location: https://www.google-analytics.com/analytics.js
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H/1.1 200
OK HuntingtonApexWeb-MediumCaps.woff
huntington-ir.com/fonts/ 41 KB
41 KB 211ms
122ms Font
application/octet-stream 216.226.155.194
WOW-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: http://huntington-ir.com/fonts/HuntingtonApexWeb-MediumCaps.woff
Requested by: Host: huntington-ir.com
URL: http://huntington-ir.com/styles/toolkit.css
Protocol: HTTP/1.1
Server: 216.226.155.194 Columbus, United States, ASN12083 (WOW-INTERNET, US),
Reverse DNS: mailsvr.investquest.com
Software: Apache/2.0.52 (CentOS) /
Resource Hash: 443674d2610fd9f2ad64571e7c8a4500d6f1f89312a9b6634cfaf3f68f6ea239

Request headers

Referer: http://huntington-ir.com/styles/toolkit.css
Origin: http://huntington-ir.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sun, 20 Nov 2022 11:06:38 GMT
Last-Modified: Fri, 06 Sep 2019 21:54:27 GMT
Server: Apache/2.0.52 (CentOS)
ETag: "b3403d-a386-7b624ac0"
Content-Type: text/plain; charset=UTF-8
Connection: close
Accept-Ranges: bytes
Content-Length: 41862

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
207 B 23ms
22ms XHR
text/plain 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j98&a=1023718446&t=pageview&_s=1&dl=http%3A%2F%2Fhuntington-ir.com%2F&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=821495996&gjid=686689354&cid=1971541174.1668942399&tid=UA-1440017-6&_gid=1604118660.1668942399&_r=1&_slc=1&z=472334000

Requested by

Host: www.google-analytics.com
URL: http://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://huntington-ir.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 20 Nov 2022 11:06:38 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: http://huntington-ir.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Huntington Bank (Banking)

33 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.huntington-ir.com/	1970-01-20 17:11:42	Name: _ga Value: GA1.2.1971541174.1668942399
.huntington-ir.com/	1970-01-20 07:37:08	Name: _gid Value: GA1.2.1604118660.1668942399
.huntington-ir.com/	1970-01-20 07:35:42	Name: _gat Value: 1
huntington-ir.com/	1970-01-20 16:21:18	Name: loginCookie Value: personalLogin

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

huntington-ir.com
ir.tcfbank.com
www.google-analytics.com
www.huntington.com
2.16.241.92
216.226.155.194
23.36.163.251
2a00:1450:4001:82b::200e
04139845ce14169e9b9cfad22c4a879dce68914b3875e71112b28bafbf96bf56
17e308faef5acc6838e7b3cf8673092abb4359d1c8d1d6a88d0e9c724d14eadf
36cbc5b49d0e61aa818097c25690241285f19c79437ee559d8a6ce5764a307d8
38c973e72b29d0c5f054034abecb6f92d1f30fac5aeeb5d0300de1cce156ade3
443674d2610fd9f2ad64571e7c8a4500d6f1f89312a9b6634cfaf3f68f6ea239
5de537351edba81c85245eac099b5eb3a7e59408f3eea0b8f18cda7eae600d65
8eda4f79f753bcec676f1e351880590e366ddf47dac4ced87e766ced8dd7146d
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
b626cacce5c3456c70aea87181809a5e8cf07936fc644080870637d42c38af8a
b829e666e60ea0bd215c8688e67e7e810687358d6cfdf3d9d8f3bde12fb78d51
c4fd6530994f6fed74c72a649f4938d2e2f97eb167c179314fc39b400c0aadb3
cc0c10079662c9b244ede88022ef8316e7902d0789acedb11134c413bcbdb5d1
d0fa57b694e54da5e499dd824c97cf63f0c6b50771912f048bc46d457367f86a
eeb3a59fa1b1f899472677b9c3536c3ea8cf31b3c115480b23221e66e003912d
f942a8005da6ee2aa0caa6bde29c49edb76317f75befa8c5f4308859b614c7f8

huntington-ir.com Open in urlscan Pro 216.226.155.194 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

16 Requests

19 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

1187 kBTransfer

1214 kBSize

4 Cookies

14 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

33 JavaScript Global Variables

4 Cookies

Indicators

huntington-ir.com Open in urlscan Pro
216.226.155.194 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

19 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

1187 kB
Transfer

1214 kB
Size

4
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!