urlscan.io logo urlscan.io
SecurityTrails logo

secure-a5.duckdns.org Open in urlscan Pro
3.23.50.56  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://secure-a5.duckdns.org/
Submission: On July 29 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 1 countries across 5 domains to perform 28 HTTP transactions. The main IP is 3.23.50.56, located in Columbus, United States and belongs to AMAZON-02, US. The main domain is secure-a5.duckdns.org.
TLS certificate: Issued by R3 on July 29th 2022. Valid for: 3 months.
This is the only time secure-a5.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: M&T Bank (Banking)

Domain & IP information

IP Address AS Autonomous System
20 3.23.50.56 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2600:9000:249... 16509 (AMAZON-02)
2 2600:9000:223... 16509 (AMAZON-02)
2 2600:9000:225... 16509 (AMAZON-02)
28 6
20    3.23.50.56 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-23-50-56.us-east-2.compute.amazonaws.com
secure-a5.duckdns.org
1    2606:4700::6812:7134 (United States)

ASN13335 (CLOUDFLARENET, US)
locations.mtb.com
2    2600:9000:2490:1e00:a:6cdf:4440:93a1 (United States)

ASN16509 (AMAZON-02, US)
1.a79ab95c1589a13f8a4cab612bc71f9f7.com
2    2600:9000:223f:a600:1e:54f1:26c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
1.b406929acabac9b095f124c81bdfcf57f.com
2    2600:9000:2250:cc00:13:ab57:d440:93a1 (United States)

ASN16509 (AMAZON-02, US)
1.c81358859121583b7adf2ace89cb39f44.com
Apex Domain
Subdomains		 Transfer
20 duckdns.org
secure-a5.duckdns.org
2 MB
2 c81358859121583b7adf2ace89cb39f44.com
1.c81358859121583b7adf2ace89cb39f44.com — Cisco Umbrella Rank: 19264
4 KB
2 b406929acabac9b095f124c81bdfcf57f.com
1.b406929acabac9b095f124c81bdfcf57f.com — Cisco Umbrella Rank: 19129
4 KB
2 a79ab95c1589a13f8a4cab612bc71f9f7.com
1.a79ab95c1589a13f8a4cab612bc71f9f7.com — Cisco Umbrella Rank: 19287
4 KB
1 mtb.com
locations.mtb.com — Cisco Umbrella Rank: 275572
1 KB
28 5
Domain Requested by
20 secure-a5.duckdns.org secure-a5.duckdns.org
2 1.c81358859121583b7adf2ace89cb39f44.com secure-a5.duckdns.org
1.c81358859121583b7adf2ace89cb39f44.com
2 1.b406929acabac9b095f124c81bdfcf57f.com secure-a5.duckdns.org
1.b406929acabac9b095f124c81bdfcf57f.com
2 1.a79ab95c1589a13f8a4cab612bc71f9f7.com secure-a5.duckdns.org
1.a79ab95c1589a13f8a4cab612bc71f9f7.com
1 locations.mtb.com secure-a5.duckdns.org
28 5
Subject Issuer Validity Valid
secure-a5.duckdns.org
R3		 2022-07-29 -
2022-10-27		 3 months crt.sh
locations.mtb.com
Cloudflare Inc ECC CA-3		 2021-09-03 -
2022-09-02		 a year crt.sh
*.a79ab95c1589a13f8a4cab612bc71f9f7.com
Sectigo RSA Domain Validation Secure Server CA		 2022-04-04 -
2023-04-04		 a year crt.sh
*.b406929acabac9b095f124c81bdfcf57f.com
Sectigo RSA Domain Validation Secure Server CA		 2022-04-06 -
2023-04-07		 a year crt.sh
*.c81358859121583b7adf2ace89cb39f44.com
Sectigo RSA Domain Validation Secure Server CA		 2022-04-06 -
2023-04-07		 a year crt.sh

This page contains 4 frames:

Primary Page: https://secure-a5.duckdns.org/
Frame ID: 761434B8E029627F0B01B919B2746E87
Requests: 22 HTTP requests in this frame

Frame: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Frame ID: 9FDF9091377AC66DD9D9D6ABAC02F9FF
Requests: 2 HTTP requests in this frame

Frame: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Frame ID: EB14006CB6BB825A7F08FD57C6A4F5C7
Requests: 2 HTTP requests in this frame

Frame: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Frame ID: 4BCFC4BF825513DDDE40D3A2E60840F5
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Log in to M&T Online Banking or Commercial Treasury CenterNavigation Menu

Detected technologies

Overall confidence: 100%
Detected patterns
  • <div class="[^"]*aem-Grid
  • /etc\.clientlibs/

Page Statistics

28
Requests

96 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

6
IPs

1
Countries

2185 kB
Transfer

2385 kB
Size

5
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

28 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
secure-a5.duckdns.org/ 		60 KB
18 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://secure-a5.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.23.50.56 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-50-56.us-east-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
7919187b1c7599b76505fc3c5b2924437d0f9655e0c9aa221c82db4087b720c1

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=utf-8
Date
Fri, 29 Jul 2022 23:50:58 GMT
Server
nginx/1.18.0 (Ubuntu)
Transfer-Encoding
chunked
clientlib-base.css
secure-a5.duckdns.org/static/etc.clientlibs/mtb-web/clientlibs/ 		421 KB
421 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://secure-a5.duckdns.org/static/etc.clientlibs/mtb-web/clientlibs/clientlib-base.css
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.23.50.56 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-50-56.us-east-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
9ad08c40c734a71d25ea6d1d517e6ac15eb0aa5d986b1eb7dac21edfe957fc0d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure-a5.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 29 Jul 2022 23:50:58 GMT
Last-Modified
Fri, 29 Jul 2022 08:30:21 GMT
Server
nginx/1.18.0 (Ubuntu)
Content-Type
text/css; charset=utf-8
Cache-Control
no-cache
Content-Disposition
inline; filename=clientlib-base.css
Connection
keep-alive
Content-Length
431264
mtb_app_wbk.js
secure-a5.duckdns.org/onlinebanking.mtb.com/Assets/js/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://secure-a5.duckdns.org/onlinebanking.mtb.com/Assets/js/mtb_app_wbk.js
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.23.50.56 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-50-56.us-east-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure-a5.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 29 Jul 2022 23:50:58 GMT
Content-Encoding
gzip
Server
nginx/1.18.0 (Ubuntu)
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=utf-8
cdsession.js
secure-a5.duckdns.org/static/content/dam/mtb-web/scripts/ 		605 KB
605 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure-a5.duckdns.org/static/content/dam/mtb-web/scripts/cdsession.js
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.23.50.56 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-50-56.us-east-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
302462d4283c45e7405dcaf5036c9f1e34982c47baaa0a39c2b45e6cb9a203f4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure-a5.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 29 Jul 2022 23:50:58 GMT
Last-Modified
Fri, 29 Jul 2022 08:27:35 GMT
Server
nginx/1.18.0 (Ubuntu)
Content-Type
text/javascript; charset=utf-8
Cache-Control
no-cache
Content-Disposition
inline; filename=cdsession.js
Connection
keep-alive
Content-Length
619717
vendor.js
secure-a5.duckdns.org/static/etc.clientlibs/axp-common/clientlibs/ 		236 KB
237 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure-a5.duckdns.org/static/etc.clientlibs/axp-common/clientlibs/vendor.js
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.23.50.56 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-50-56.us-east-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
c5bac5c06dfc6a8b1547af4e6dfa0d784f70db7c92cfe1e97c45e962f0283d0c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure-a5.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 29 Jul 2022 23:50:58 GMT
Last-Modified
Fri, 29 Jul 2022 08:30:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Content-Type
text/javascript; charset=utf-8
Cache-Control
no-cache
Content-Disposition
inline; filename=vendor.js
Connection
keep-alive
Content-Length
242127
utag.sync.js
secure-a5.duckdns.org/tags.tiqcdn.com/utag/mtbank/main/prod/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://secure-a5.duckdns.org/tags.tiqcdn.com/utag/mtbank/main/prod/utag.sync.js
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.23.50.56 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-50-56.us-east-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure-a5.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 29 Jul 2022 23:50:58 GMT
Content-Encoding
gzip
Server
nginx/1.18.0 (Ubuntu)
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=utf-8
status.js
secure-a5.duckdns.org/static/content/dam/mtb-web/scripts/ 		8 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure-a5.duckdns.org/static/content/dam/mtb-web/scripts/status.js
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.23.50.56 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-50-56.us-east-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
25d8581bd33a35093f77e4327a1f7de449d6769f60964b96acb31b109e12a49d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure-a5.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 29 Jul 2022 23:50:58 GMT
Last-Modified
Fri, 29 Jul 2022 08:27:55 GMT
Server
nginx/1.18.0 (Ubuntu)
Content-Type
text/javascript; charset=utf-8
Cache-Control
no-cache
Content-Disposition
inline; filename=status.js
Connection
keep-alive
Content-Length
7688
white%2520logo.png
secure-a5.duckdns.org/static/content/dam/mtb-web/logos/ 		207 B
207 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure-a5.duckdns.org/static/content/dam/mtb-web/logos/white%2520logo.png
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.23.50.56 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-50-56.us-east-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e9639e3c4681ce85f852fbac48e2eeee5ba51296dbfec57c200d59b76237ab80

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure-a5.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 29 Jul 2022 23:50:59 GMT
Content-Encoding
gzip
Server
nginx/1.18.0 (Ubuntu)
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=utf-8
axp.js
secure-a5.duckdns.org/static/content/dam/mtb-web/scripts/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure-a5.duckdns.org/static/content/dam/mtb-web/scripts/axp.js
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.23.50.56 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-50-56.us-east-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
74b2301f83da81152130c5ada202f02c790977b4fe669ed0b6c0b59ffba63174

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure-a5.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 29 Jul 2022 23:50:59 GMT
Last-Modified
Fri, 29 Jul 2022 08:27:32 GMT
Server
nginx/1.18.0 (Ubuntu)
Content-Type
text/javascript; charset=utf-8
Cache-Control
no-cache
Content-Disposition
inline; filename=axp.js
Connection
keep-alive
Content-Length
3269
allAlertobject.js
secure-a5.duckdns.org/static/content/dam/mtb-web/scripts/alert_scripts/ 		21 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure-a5.duckdns.org/static/content/dam/mtb-web/scripts/alert_scripts/allAlertobject.js
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.23.50.56 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-50-56.us-east-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
ea25eb115fe5be61c46f96dd01fdea779974da127b48dd8fe1002baac6b6780c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure-a5.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 29 Jul 2022 23:50:59 GMT
Last-Modified
Fri, 29 Jul 2022 08:27:31 GMT
Server
nginx/1.18.0 (Ubuntu)
Content-Type
text/javascript; charset=utf-8
Cache-Control
no-cache
Content-Disposition
inline; filename=allAlertobject.js
Connection
keep-alive
Content-Length
21843
equal-housing-lender-logo.png
secure-a5.duckdns.org/static/content/dam/mtb-web/coupon/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure-a5.duckdns.org/static/content/dam/mtb-web/coupon/equal-housing-lender-logo.png
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.23.50.56 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-50-56.us-east-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
46c43686825a8cb8bf832253977abfb4871e5d9014cb6912e8519c736a6253d3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure-a5.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 29 Jul 2022 23:50:59 GMT
Last-Modified
Fri, 29 Jul 2022 08:26:45 GMT
Server
nginx/1.18.0 (Ubuntu)
Content-Type
image/png
Cache-Control
no-cache
Content-Disposition
inline; filename=equal-housing-lender-logo.png
Connection
keep-alive
Content-Length
1509
kensington-mural-olb-de
secure-a5.duckdns.org/static/content/experience-fragments/mtb-web/login_modals/login-v2-fragments/multicultural-communities/_jcr_content/root/columns/col_1/image_copy_867550798_1442900878.coreimg.j... 		111 KB
112 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure-a5.duckdns.org/static/content/experience-fragments/mtb-web/login_modals/login-v2-fragments/multicultural-communities/_jcr_content/root/columns/col_1/image_copy_867550798_1442900878.coreimg.jpeg/1648140/kensington-mural-olb-de
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.23.50.56 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-50-56.us-east-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3600cc522d109bf4d7aeb56960790240e80d9f22f6ae99e9a77d020bdf8f3cd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure-a5.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 29 Jul 2022 23:50:59 GMT
Last-Modified
Fri, 29 Jul 2022 08:29:31 GMT
Server
nginx/1.18.0 (Ubuntu)
Content-Type
application/octet-stream
Cache-Control
no-cache
Content-Disposition
inline; filename=kensington-mural-olb-de
Connection
keep-alive
Content-Length
113904
kensington-mural-olb-mobile.jpg
secure-a5.duckdns.org/static/content/experience-fragments/mtb-web/login_modals/login-v2-fragments/multicultural-communities/_jcr_content/root/columns/col_1/image_copy.coreimg.jpeg/1647887564359/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure-a5.duckdns.org/static/content/experience-fragments/mtb-web/login_modals/login-v2-fragments/multicultural-communities/_jcr_content/root/columns/col_1/image_copy.coreimg.jpeg/1647887564359/kensington-mural-olb-mobile.jpg
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.23.50.56 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-50-56.us-east-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
d0ebd4a04dc4040c44e7d68b56fbfcc1dbcccf03de96771a60e26f21a76359a0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure-a5.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 29 Jul 2022 23:50:59 GMT
Last-Modified
Fri, 29 Jul 2022 08:29:27 GMT
Server
nginx/1.18.0 (Ubuntu)
Content-Type
image/jpeg
Cache-Control
no-cache
Content-Disposition
inline; filename=kensington-mural-olb-mobile.jpg
Connection
keep-alive
Content-Length
14941
kensington-mural-olb-desktop
secure-a5.duckdns.org/static/content/experience-fragments/mtb-web/login_modals/login-v2-fragments/multicultural-communities/_jcr_content/root/columns/col_1/image_copy_867550798.coreimg.jpeg/1647887... 		111 KB
112 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure-a5.duckdns.org/static/content/experience-fragments/mtb-web/login_modals/login-v2-fragments/multicultural-communities/_jcr_content/root/columns/col_1/image_copy_867550798.coreimg.jpeg/1647887633007/kensington-mural-olb-desktop
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.23.50.56 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-50-56.us-east-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3600cc522d109bf4d7aeb56960790240e80d9f22f6ae99e9a77d020bdf8f3cd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure-a5.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 29 Jul 2022 23:50:59 GMT
Last-Modified
Fri, 29 Jul 2022 08:29:29 GMT
Server
nginx/1.18.0 (Ubuntu)
Content-Type
application/octet-stream
Cache-Control
no-cache
Content-Disposition
inline; filename=kensington-mural-olb-desktop
Connection
keep-alive
Content-Length
113904
clientlib-base.js
secure-a5.duckdns.org/static/etc.clientlibs/mtb-web/clientlibs/ 		395 KB
395 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure-a5.duckdns.org/static/etc.clientlibs/mtb-web/clientlibs/clientlib-base.js
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.23.50.56 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-50-56.us-east-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3960cdb6b4a1c46d19d1d974c8bd8c429b12fbd7dde63617fd008b6b5c0671da

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure-a5.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 29 Jul 2022 23:50:59 GMT
Last-Modified
Fri, 29 Jul 2022 08:30:23 GMT
Server
nginx/1.18.0 (Ubuntu)
Content-Type
text/javascript; charset=utf-8
Cache-Control
no-cache
Content-Disposition
inline; filename=clientlib-base.js
Connection
keep-alive
Content-Length
404045
0d96a358-2611-4ac2-a313-9663f1caaecb
https://secure-a5.duckdns.org/ 		165 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://secure-a5.duckdns.org/0d96a358-2611-4ac2-a313-9663f1caaecb
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
25e521f17135f161c1f02f0555af227292ab009967c461380e3135c414f288e6

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Length
169098
mandtbaltoweb-book.woff
secure-a5.duckdns.org/static/etc.clientlibs/mtb-web/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/ 		66 KB
66 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://secure-a5.duckdns.org/static/etc.clientlibs/mtb-web/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-book.woff
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/static/etc.clientlibs/mtb-web/clientlibs/clientlib-base.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.23.50.56 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-50-56.us-east-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
4029a5a081992259f4e529190b49dbba893931da4e843dd203449f1b9a4509d2

Request headers

Referer
https://secure-a5.duckdns.org/static/etc.clientlibs/mtb-web/clientlibs/clientlib-base.css
Origin
https://secure-a5.duckdns.org
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 29 Jul 2022 23:50:59 GMT
Last-Modified
Fri, 29 Jul 2022 08:30:26 GMT
Server
nginx/1.18.0 (Ubuntu)
Content-Type
font/woff
Cache-Control
no-cache
Content-Disposition
inline; filename=mandtbaltoweb-book.woff
Connection
keep-alive
Content-Length
67671
mandtbaltoweb-light.woff
secure-a5.duckdns.org/static/etc.clientlibs/mtb-web/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/ 		65 KB
65 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://secure-a5.duckdns.org/static/etc.clientlibs/mtb-web/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-light.woff
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/static/etc.clientlibs/mtb-web/clientlibs/clientlib-base.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.23.50.56 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-50-56.us-east-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
18c9c9a98b2a0de85fb63e8fc0fbf0dd575b45d76cfdd22220f4c7d9caf0b99a

Request headers

Referer
https://secure-a5.duckdns.org/static/etc.clientlibs/mtb-web/clientlibs/clientlib-base.css
Origin
https://secure-a5.duckdns.org
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 29 Jul 2022 23:50:59 GMT
Last-Modified
Fri, 29 Jul 2022 08:30:27 GMT
Server
nginx/1.18.0 (Ubuntu)
Content-Type
font/woff
Cache-Control
no-cache
Content-Disposition
inline; filename=mandtbaltoweb-light.woff
Connection
keep-alive
Content-Length
66170
chevron_down.8adc6731.svg
locations.mtb.com/permanent-b0b701/assets/images/ 		970 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://locations.mtb.com/permanent-b0b701/assets/images/chevron_down.8adc6731.svg
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6812:7134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
03cc12570299da2da582ed1f055f77f31f7d77899f1ada7ced1dfeea50068298
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure-a5.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Fri, 29 Jul 2022 23:50:59 GMT
content-encoding
gzip
vary
Accept-Encoding
cf-cache-status
HIT
age
42965
x-amz-server-side-encryption
AES256
cf-ray
7329c29018979096-FRA
x-yext-subendpoint
static
content-length
568
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
AARXGC61N4NVCMKG
x-amz-id-2
5u3Rm9Ah7ZwbfcmIOfVCBxIOaDnvUX5qPuT46GjPwkYz8gQKCpa/Faq+QZd2ZC1gD1Qt8RaZx30=
surrogate-key
locations.mtb.com locations.mtb.com%2Fpermanent-b0b701%2Fassets%2Fimages%2Fchevron_down.8adc6731.svg
last-modified
Fri, 27 Aug 2021 20:52:43 GMT
server
cloudflare
etag
"050cee664fbeeeea1650f8360bc400ef"-gzip
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
x-yext-site
us2
cache-control
max-age=31536000
x-amz-version-id
null
accept-ranges
bytes
content-type
image/svg+xml
owner
sitescog-19087
mandtbaltoweb-medium.woff
secure-a5.duckdns.org/static/etc.clientlibs/mtb-web/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/ 		63 KB
63 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://secure-a5.duckdns.org/static/etc.clientlibs/mtb-web/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-medium.woff
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/static/etc.clientlibs/mtb-web/clientlibs/clientlib-base.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.23.50.56 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-50-56.us-east-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
b391b55f950528937beee7687717a4aef81196817834f1c93b099713ff738fbc

Request headers

Referer
https://secure-a5.duckdns.org/static/etc.clientlibs/mtb-web/clientlibs/clientlib-base.css
Origin
https://secure-a5.duckdns.org
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 29 Jul 2022 23:50:59 GMT
Last-Modified
Fri, 29 Jul 2022 08:30:27 GMT
Server
nginx/1.18.0 (Ubuntu)
Content-Type
font/woff
Cache-Control
no-cache
Content-Disposition
inline; filename=mandtbaltoweb-medium.woff
Connection
keep-alive
Content-Length
64318
Login-Minimal-Modal-Background.jpg
secure-a5.duckdns.org/static/content/dam/mtb-web/logos/ 		27 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure-a5.duckdns.org/static/content/dam/mtb-web/logos/Login-Minimal-Modal-Background.jpg
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.23.50.56 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-50-56.us-east-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
60f064cd48214cb73f54404a2eda28d731f49bf853509d47da070174784e11b9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secure-a5.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 29 Jul 2022 23:50:59 GMT
Last-Modified
Fri, 29 Jul 2022 08:27:05 GMT
Server
nginx/1.18.0 (Ubuntu)
Content-Type
image/jpeg
Cache-Control
no-cache
Content-Disposition
inline; filename=Login-Minimal-Modal-Background.jpg
Connection
keep-alive
Content-Length
27608
articles
secure-a5.duckdns.org/bin/wcm/ 		207 B
394 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://secure-a5.duckdns.org/bin/wcm/articles
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/static/etc.clientlibs/axp-common/clientlibs/vendor.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.23.50.56 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-23-50-56.us-east-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e9639e3c4681ce85f852fbac48e2eeee5ba51296dbfec57c200d59b76237ab80

Request headers

Accept
*/*
Referer
https://secure-a5.duckdns.org/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 29 Jul 2022 23:50:59 GMT
Content-Encoding
gzip
Server
nginx/1.18.0 (Ubuntu)
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=utf-8
crossdomain.html
1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/ Frame 9FDF 		221 B
555 B 		Document
General
Check archive.org
Download Go to
Full URL
https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/static/content/dam/mtb-web/scripts/cdsession.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:1e00:a:6cdf:4440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer
https://secure-a5.duckdns.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
2426
content-length
221
content-type
text/html
date
Fri, 29 Jul 2022 23:10:35 GMT
etag
"21e34cf6a03f570df49e212018a567d0"
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
via
1.1 6c2674fb15c38f5458794dd680986b8e.cloudfront.net (CloudFront)
x-amz-cf-id
9MaPnFAr4D6rVOnnjbGTynmPY53wdf_oXLzLE4VhV6X3c1w_S0OM2A==
x-amz-cf-pop
FRA56-P6
x-amz-version-id
null
x-cache
Hit from cloudfront
crossdomain.html
1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/ Frame EB14 		221 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/static/content/dam/mtb-web/scripts/cdsession.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223f:a600:1e:54f1:26c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer
https://secure-a5.duckdns.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
30422
content-length
221
content-type
text/html
date
Fri, 29 Jul 2022 15:23:59 GMT
etag
"21e34cf6a03f570df49e212018a567d0"
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
via
1.1 5e28951e5f2b6d7d562636473d26d7a6.cloudfront.net (CloudFront)
x-amz-cf-id
W4y5WpzM50op1GZKbFcChKHslPIO-40t86v_QEdGcttTA7zG5wP7FA==
x-amz-cf-pop
FRA56-P5
x-amz-version-id
null
x-cache
Hit from cloudfront
crossdomain.html
1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/ Frame 4BCF 		221 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Requested by
Host: secure-a5.duckdns.org
URL: https://secure-a5.duckdns.org/static/content/dam/mtb-web/scripts/cdsession.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:cc00:13:ab57:d440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer
https://secure-a5.duckdns.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
59262
content-length
221
content-type
text/html
date
Fri, 29 Jul 2022 07:23:19 GMT
etag
"21e34cf6a03f570df49e212018a567d0"
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
via
1.1 a4233498d2bd44dbd411d60d86f8334e.cloudfront.net (CloudFront)
x-amz-cf-id
swqeD0oziO5qAr4O1yHB6V--Rxc9AYhmBO4AYA-YntC_QIb79JgTaA==
x-amz-cf-pop
FRA60-P2
x-amz-version-id
null
x-cache
Hit from cloudfront
crossdomain2.12.0.5273.b96c35cc.min.js
1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/ Frame EB14 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by
Host: 1.b406929acabac9b095f124c81bdfcf57f.com
URL: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223f:a600:1e:54f1:26c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Fri, 29 Jul 2022 19:14:42 GMT
via
1.1 5e28951e5f2b6d7d562636473d26d7a6.cloudfront.net (CloudFront)
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
age
16579
etag
"9ee48a4da9c402e8a23ad085fb71f28f"
x-cache
Hit from cloudfront
x-amz-version-id
null
x-amz-cf-pop
FRA56-P5
accept-ranges
bytes
content-type
application/javascript
content-length
3227
x-amz-cf-id
iE_-L4Gzx64tCArdx60EUOwaLEyi-wKhG3sL29snSvxjJyMXu_Xc3g==
crossdomain2.12.0.5273.b96c35cc.min.js
1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/ Frame 4BCF 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by
Host: 1.c81358859121583b7adf2ace89cb39f44.com
URL: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:cc00:13:ab57:d440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Fri, 29 Jul 2022 15:40:14 GMT
via
1.1 a4233498d2bd44dbd411d60d86f8334e.cloudfront.net (CloudFront)
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
age
29447
etag
"9ee48a4da9c402e8a23ad085fb71f28f"
x-cache
Hit from cloudfront
x-amz-version-id
null
x-amz-cf-pop
FRA60-P2
accept-ranges
bytes
content-type
application/javascript
content-length
3227
x-amz-cf-id
BNzbi0itG-ynIZNO6p5UAt-ohEk8crBU2EqA0LAbUh_Fcut1Ev5rXg==
crossdomain2.12.0.5273.b96c35cc.min.js
1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/ Frame 9FDF 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by
Host: 1.a79ab95c1589a13f8a4cab612bc71f9f7.com
URL: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:1e00:a:6cdf:4440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Fri, 29 Jul 2022 23:10:41 GMT
via
1.1 6c2674fb15c38f5458794dd680986b8e.cloudfront.net (CloudFront)
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
age
2420
etag
"9ee48a4da9c402e8a23ad085fb71f28f"
x-cache
Hit from cloudfront
x-amz-version-id
null
x-amz-cf-pop
FRA56-P6
accept-ranges
bytes
content-type
application/javascript
content-length
3227
x-amz-cf-id
8Cbb-PKbUgX-NZTSeaScBO5YKMuDKJfLRA-X-TGJS6FtMsnXlFnWeQ==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: M&T Bank (Banking)

117 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| cdwpb object| cdApi object| Utils object| customEventsObject object| cookiesUtils object| modalObject object| tealiumUtils function| Hashtable function| startsWith function| DomDataCollection function| IE_FingerPrint function| Mozilla_FingerPrint function| Opera_FingerPrint function| Timer function| getRandomPort object| ProxyCollector function| BlackberryLocationCollector function| detectFields string| SEP string| PAIR string| DEV function| FingerPrint function| urlEncode function| encode_deviceprint function| decode_deviceprint function| post_deviceprint function| post_fingerprints function| add_deviceprint function| form_add_data function| form_add_deviceprint string| HTML5 string| BLACKBERRY string| UNDEFINED string| GEO_LOCATION_DEFAULT_STRUCT object| geoLocator boolean| geoLocatorStatus function| detectDeviceCollectionAPIMode function| init function| startCollection function| stopCollection function| getGeolocationStruct function| HTML5LocationCollector object| UIEventCollector function| UIEvent function| InteractionElement function| UIElementList function| activeXDetect function| stripIllegalChars function| stripFullPath object| BrowserDetect function| convertTimestampToGMT function| getTimestampInMillis function| debug function| $ function| jQuery function| Cookies function| forceIE89Synchronicity object| lazySizes function| mainNavActiveChecker object| homepages function| moveAlertBanner function| DownSlider function| getPageAlertHtml function| getLoginAlertHtml function| alertActiveCheck function| showAlert function| ShowPageAlert function| ShowLoginAlert function| removeBadAlerts function| fixColWhiteBg function| showMobileAlert function| showLoginAlert object| allAlerts function| closeLoginAlert function| handleLoginAlerts function| populateUserId function| cdSession object| allArticlesInCategory function| setArticles function| loadMoreArticles function| makePullQ function| bindEmailShare function| setArticleShare function| setBgImgFromAttr object| $body object| $modalContainer object| $modalClose undefined| $currentModal undefined| $originalModalLocation object| $openModalButton object| $firstActionableModalElement undefined| $modalAnchor number| $eventFired object| modalLibrary function| applyCustomColWidths object| articleCarouselLibrary function| SetMinMaxDateAttr function| FormatTelOnBlurBind function| FormatTelOnBlur function| CustomDateFldValidation function| ValidateDateOnBlur function| evenItemsH function| setBreakPointBodyAttr object| $jscomp string| style string| d string| t string| m object| s

5 Cookies

Domain/Path Name / Value
.secure-a5.duckdns.org/ Name: cdContextId
Value: 1
.secure-a5.duckdns.org/ Name: bmuid
Value: 1659138659521-E14736A7-13E9-48DE-98AE-F1078FCD2977
secure-a5.duckdns.org/ Name: cdSessionId
Value: ed2aa66d-2242-4632-abb9-03d3ce322c7f
.locations.mtb.com/ Name: __cf_bm
Value: E91JkET_xQVmR3hhdRj.LKrf0_O0AxGvZ0RJwxjwsQY-1659138659-0-AbpvjVVw/KthiLzl4RU0C3DGIGRh2f+q8nnPkVmtZjO5JwNv41FtvPgDOkhPCCeB7NyKd7UTNFx0l+LQCm1lqu0=
.secure-a5.duckdns.org/ Name: cdSNum
Value: 1659138660027-sjn0000507-43a4ae8f-3ae9-4bda-b5a0-56b7e8a37ad4

4 Console Messages

Source Level URL
Text
network error URL: https://secure-a5.duckdns.org/onlinebanking.mtb.com/Assets/js/mtb_app_wbk.js
Message:
Failed to load resource: the server responded with a status of 404 (NOT FOUND)
network error URL: https://secure-a5.duckdns.org/tags.tiqcdn.com/utag/mtbank/main/prod/utag.sync.js
Message:
Failed to load resource: the server responded with a status of 404 (NOT FOUND)
network error URL: https://secure-a5.duckdns.org/static/content/dam/mtb-web/logos/white%2520logo.png
Message:
Failed to load resource: the server responded with a status of 404 (NOT FOUND)
network error URL: https://secure-a5.duckdns.org/bin/wcm/articles
Message:
Failed to load resource: the server responded with a status of 404 (NOT FOUND)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1.a79ab95c1589a13f8a4cab612bc71f9f7.com
1.b406929acabac9b095f124c81bdfcf57f.com
1.c81358859121583b7adf2ace89cb39f44.com
locations.mtb.com
secure-a5.duckdns.org
2600:9000:223f:a600:1e:54f1:26c0:93a1
2600:9000:2250:cc00:13:ab57:d440:93a1
2600:9000:2490:1e00:a:6cdf:4440:93a1
2606:4700::6812:7134
3.23.50.56
03cc12570299da2da582ed1f055f77f31f7d77899f1ada7ced1dfeea50068298
0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6
18c9c9a98b2a0de85fb63e8fc0fbf0dd575b45d76cfdd22220f4c7d9caf0b99a
25d8581bd33a35093f77e4327a1f7de449d6769f60964b96acb31b109e12a49d
25e521f17135f161c1f02f0555af227292ab009967c461380e3135c414f288e6
302462d4283c45e7405dcaf5036c9f1e34982c47baaa0a39c2b45e6cb9a203f4
3960cdb6b4a1c46d19d1d974c8bd8c429b12fbd7dde63617fd008b6b5c0671da
4029a5a081992259f4e529190b49dbba893931da4e843dd203449f1b9a4509d2
46c43686825a8cb8bf832253977abfb4871e5d9014cb6912e8519c736a6253d3
60f064cd48214cb73f54404a2eda28d731f49bf853509d47da070174784e11b9
74b2301f83da81152130c5ada202f02c790977b4fe669ed0b6c0b59ffba63174
7919187b1c7599b76505fc3c5b2924437d0f9655e0c9aa221c82db4087b720c1
9ad08c40c734a71d25ea6d1d517e6ac15eb0aa5d986b1eb7dac21edfe957fc0d
9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622
b391b55f950528937beee7687717a4aef81196817834f1c93b099713ff738fbc
c5bac5c06dfc6a8b1547af4e6dfa0d784f70db7c92cfe1e97c45e962f0283d0c
d0ebd4a04dc4040c44e7d68b56fbfcc1dbcccf03de96771a60e26f21a76359a0
e3600cc522d109bf4d7aeb56960790240e80d9f22f6ae99e9a77d020bdf8f3cd
e9639e3c4681ce85f852fbac48e2eeee5ba51296dbfec57c200d59b76237ab80
ea25eb115fe5be61c46f96dd01fdea779974da127b48dd8fe1002baac6b6780c