terapiaespecializada.es
Open in
urlscan Pro
5.135.199.226
Malicious Activity!
Public Scan
Submission: On March 02 via automatic, source openphish — Scanned from ES
Summary
TLS certificate: Issued by R3 on February 4th 2023. Valid for: 3 months.
This is the only time terapiaespecializada.es was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: M&T Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
10 | 5.135.199.226 5.135.199.226 | 16276 (OVH) (OVH) | |
1 | 13.35.166.37 13.35.166.37 | 16509 (AMAZON-02) (AMAZON-02) | |
11 | 2 |
ASN16509 (AMAZON-02, US)
PTR: server-13-35-166-37.tpe50.r.cloudfront.net
nexus.ensighten.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
terapiaespecializada.es
terapiaespecializada.es |
217 KB |
1 |
ensighten.com
nexus.ensighten.com — Cisco Umbrella Rank: 2969 |
450 B |
11 | 2 |
Domain | Requested by | |
---|---|---|
10 | terapiaespecializada.es |
terapiaespecializada.es
|
1 | nexus.ensighten.com |
terapiaespecializada.es
|
11 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
terapiaespecializada.es R3 |
2023-02-04 - 2023-05-05 |
3 months | crt.sh |
nexus.ensighten.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-10-07 - 2023-10-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://terapiaespecializada.es/mtb/app/verify.php
Frame ID: 5241C57A52B28CA65AF2EC625F389782
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
Verification | M&T BankDetected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Bootstrap (Web Frameworks) Expand
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Ensighten (Tag Managers) Expand
Detected patterns
- //nexus\.ensighten\.com/
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
verify.php
terapiaespecializada.es/mtb/app/ |
9 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mtb.css
terapiaespecializada.es/mtb/libraries/css/ |
252 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Bootstrap.js
terapiaespecializada.es/mtb/libraries/js/ |
52 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mtb-logo.svg
terapiaespecializada.es/mtb/libraries/img/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mtb-equalhousinglender.svg
terapiaespecializada.es/mtb/libraries/img/ |
230 B 391 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mtb-entrust.svg
terapiaespecializada.es/mtb/libraries/img/ |
1 KB 916 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
terapiaespecializada.es/mtb/libraries/ |
156 KB 37 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.mask.js
terapiaespecializada.es/mtb/libraries/ |
20 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mandtbaltoweb-book.woff
terapiaespecializada.es/mtb/libraries/fonts/ |
66 KB 66 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mandtbaltoweb-medium.woff
terapiaespecializada.es/mtb/libraries/fonts/ |
63 KB 63 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
serverComponent.php
nexus.ensighten.com/mtbank/OE-Prod/ |
60 B 450 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: M&T Bank (Banking)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| ensBootstraps object| Bootstrapper function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
terapiaespecializada.es/ | Name: PHPSESSID Value: bl0n9ta6fnc380e6o4lc61gk6n |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
nexus.ensighten.com
terapiaespecializada.es
13.35.166.37
5.135.199.226
12e4dcb3be374e3cacefbf8c22bdd7d74ed94abaef2c7a6159ced5b0e8aae872
4029a5a081992259f4e529190b49dbba893931da4e843dd203449f1b9a4509d2
5f5b0d9f678fe446631a33a4cbbe891a01b0ed972143702e67ae6617367096ac
6e1297448cf350be58ab05a6c413fa4d4b97440a0a3ab97fb03c09ff49af5ad4
ad68c8c7e80948313b864c7f1f78556234fe7d5fc778337a7bf0db2efd0c7468
b080e4b98b9a6a6a8a95a0034c7aa46fd054f5a67873912ff6107f934b7553f4
b2ef3bd17aa6bc2daa7b1209f7848b30c64f3068e43162b09a216639ab430ce5
b391b55f950528937beee7687717a4aef81196817834f1c93b099713ff738fbc
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
d18b82a04723d0bdf0124a010cdc5c916fa42efd52309d49838255a483f35146
d58eb2802f72d0c6b1d944a1335e8fb914af44b51fe16097aad994c15b8cfbad