summer-bread-0a54.xvv.workers.dev Open in urlscan Pro
172.67.161.144  Malicious Activity! Public Scan

12 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request / Show response summer-bread-0a54.xvv.workers.dev/	37 KB 8 KB	52ms 16ms	Document text/html	172.67.161.144 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://summer-bread-0a54.xvv.workers.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.161.144 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fc5a6e6097664e74426d2662e0d5c1fc9ee5e662ef41982145ac1326ed740e09 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-ray 86f182418af54d9c-FRA content-encoding br content-type text/html;charset=UTF-8 date Thu, 04 Apr 2024 13:05:14 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5aev9dA0DlTHeXNlPSuG9AH6JL7QX8zyih6G%2BbGB3isIt2C581UXqEL8j7%2FwIf2ldatKtEL9E5ToahDpDTfjnIryeOJ4Jx4kIL4MBkjJlx3wufJW%2BBBFWRtWGkq2YNvNJlMfvD5Sp5iz5ZZUJVBZ2bGONSE%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H3	200	0856addebbab20004666d7ee90a9c1cc91098e9a327422308cb14c168b5247d9da57f332fcae7aa2 Show response summer-bread-0a54.xvv.workers.dev/TSPD/	37 KB 8 KB	25ms 25ms	Script text/html	172.67.161.144 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://summer-bread-0a54.xvv.workers.dev/TSPD/0856addebbab20004666d7ee90a9c1cc91098e9a327422308cb14c168b5247d9da57f332fcae7aa2?type=9 Requested by Host: summer-bread-0a54.xvv.workers.dev URL: https://summer-bread-0a54.xvv.workers.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.161.144 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fc5a6e6097664e74426d2662e0d5c1fc9ee5e662ef41982145ac1326ed740e09 Request headers accept-language de-DE,de;q=0.9 Referer https://summer-bread-0a54.xvv.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 Response headers date Thu, 04 Apr 2024 13:05:14 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x279UOo%2B7OcKFNx1AILoWHhpnJPbc487UYxAT1SWADrtnsYkZwzwCc49hUzGjRzyIQSqQJ4ai%2FI916MDDPT%2BYpCCYYctkCuVVLxt7Frf2%2Bt%2FRTog6dSjy2uweJcdna2N1RDYsepoiX7cbkg71l8DDqnXFmU%3D"}],"group":"cf-nel","max_age":604800} content-type text/html;charset=UTF-8 cf-ray 86f18241bb4a4d9c-FRA alt-svc h3=":443"; ma=86400
GET H3	200	0856addebbab20004666d7ee90a9c1cc91098e9a327422308cb14c168b5247d9da57f332fcae7aa2 Show response summer-bread-0a54.xvv.workers.dev/TSPD/	37 KB 8 KB	17ms 17ms	Script text/html	172.67.161.144 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://summer-bread-0a54.xvv.workers.dev/TSPD/0856addebbab20004666d7ee90a9c1cc91098e9a327422308cb14c168b5247d9da57f332fcae7aa2?type=17 Requested by Host: summer-bread-0a54.xvv.workers.dev URL: https://summer-bread-0a54.xvv.workers.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.161.144 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fc5a6e6097664e74426d2662e0d5c1fc9ee5e662ef41982145ac1326ed740e09 Request headers accept-language de-DE,de;q=0.9 Referer https://summer-bread-0a54.xvv.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 Response headers date Thu, 04 Apr 2024 13:05:14 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ojYC0f3z%2BrJwD1nhYAuM%2B1vAxc4UR%2FY0Py%2FkKx5HMP7KjYPH9cqtiG%2BOHi8p%2F%2F8W3qssRYbX9CQcuNKF4LGfNMgwSGHDHG8dS2NY38DxMEelDuO8j0YBKMfjkH%2BgIcaSsCXUcUK3cLE33mBdGoUs4zO3rt0%3D"}],"group":"cf-nel","max_age":604800} content-type text/html;charset=UTF-8 cf-ray 86f18241bb514d9c-FRA alt-svc h3=":443"; ma=86400
GET H3	200	mtb_app_wbk.js Show response summer-bread-0a54.xvv.workers.dev/Assets/js/	37 KB 8 KB	19ms 18ms	Script text/html	172.67.161.144 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://summer-bread-0a54.xvv.workers.dev/Assets/js/mtb_app_wbk.js Requested by Host: summer-bread-0a54.xvv.workers.dev URL: https://summer-bread-0a54.xvv.workers.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.161.144 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fc5a6e6097664e74426d2662e0d5c1fc9ee5e662ef41982145ac1326ed740e09 Request headers accept-language de-DE,de;q=0.9 Referer https://summer-bread-0a54.xvv.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 Response headers date Thu, 04 Apr 2024 13:05:14 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cwUJkaIEnctb1Y7j5JmxYQHf9r2guWclDSGIAO4gGJtEZi6%2B2fVOfqtjhh%2Bc0k1Bl30nlSI5CglKLuVisMQ%2BUU1oCnhim1wDp9TI3n3A%2FYLtNr5NTJ80TAmytIv94MfO463m526S92zbz189fTqUDMHVazo%3D"}],"group":"cf-nel","max_age":604800} content-type text/html;charset=UTF-8 cf-ray 86f18241bb554d9c-FRA alt-svc h3=":443"; ma=86400
GET H/1.1	200 OK	css.mtb resources.mtb.com/r/simple-layout-responsive/	253 KB 35 KB	1078ms 122ms	Stylesheet text/css	24.75.29.77 LEVEL3
General Check archive.org Show headers Download Go to Full URL https://resources.mtb.com/r/simple-layout-responsive/css.mtb?v=11242021100000 Requested by Host: summer-bread-0a54.xvv.workers.dev URL: https://summer-bread-0a54.xvv.workers.dev/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 24.75.29.77 Buffalo, United States, ASN3356 (LEVEL3, US), Reverse DNS Software / Resource Hash 58e1f9b6898a00101a5241e6524fca06fbab5abc06f1b0b52e4c0a6ceae70bf8 Security Headers Name Value X-Frame-Options ALLOW-FROM https://mtb.com/ Request headers accept-language de-DE,de;q=0.9 Referer https://summer-bread-0a54.xvv.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 Response headers Date Thu, 04 Apr 2024 13:05:15 GMT Content-Encoding gzip Last-Modified Thu, 04 Apr 2024 13:05:14 GMT X-Srv B-STC-003 ETag "1712235915:dtagent10285240307101407S3u4" ntCoent-Length 259098 Vary User-Agent X-FRAME-OPTIONS ALLOW-FROM https://mtb.com/ Content-Type text/css; charset=utf-8 Access-Control-Allow-Origin * Cache-Control private Transfer-Encoding chunked Server-Timing dtSInfo;desc="0", dtRpid;desc="-108210253" Expires Fri, 04 Apr 2025 13:05:15 GMT
GET H3	200	ruxitagentjs_ICA2Vfhjqrux_10233220201140653.js Show response summer-bread-0a54.xvv.workers.dev/	37 KB 8 KB	25ms 25ms	Script text/html	172.67.161.144 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://summer-bread-0a54.xvv.workers.dev/ruxitagentjs_ICA2Vfhjqrux_10233220201140653.js Requested by Host: summer-bread-0a54.xvv.workers.dev URL: https://summer-bread-0a54.xvv.workers.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.161.144 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fc5a6e6097664e74426d2662e0d5c1fc9ee5e662ef41982145ac1326ed740e09 Request headers accept-language de-DE,de;q=0.9 Referer https://summer-bread-0a54.xvv.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 Response headers date Thu, 04 Apr 2024 13:05:14 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nFzV6bvKLQZv4MsmGVv9Z4pUA2r9cFI92yaekcR%2Fo7uL7RAo4ex6sUSbiPtSI541xKuNnm722SlwCjGZLc463neYZwTn2w71ZCXjRTcK7tByQUjD3sLkNR4zRryilx4ZwKAMreFif2NWPaeJM2g%2Frb49i4g%3D"}],"group":"cf-nel","max_age":604800} content-type text/html;charset=UTF-8 cf-ray 86f18241bb574d9c-FRA alt-svc h3=":443"; ma=86400
GET H3	200	tealium_prod.js Show response summer-bread-0a54.xvv.workers.dev/Assets/js/	37 KB 8 KB	31ms 30ms	Script text/html	172.67.161.144 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://summer-bread-0a54.xvv.workers.dev/Assets/js/tealium_prod.js Requested by Host: summer-bread-0a54.xvv.workers.dev URL: https://summer-bread-0a54.xvv.workers.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.161.144 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fc5a6e6097664e74426d2662e0d5c1fc9ee5e662ef41982145ac1326ed740e09 Request headers accept-language de-DE,de;q=0.9 Referer https://summer-bread-0a54.xvv.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 Response headers date Thu, 04 Apr 2024 13:05:14 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0sPDioJtNYv9q8pSy9YfFeDHTLnpyKHL4mwMlahEgLmOrpHbNP7yL863IROk2Lk%2Bv2xzY2U5CVkkTURBYi7syDyNfGSY479cMXHESBtIfu1L3b2cxtDG40p7X0%2FJXZhLWoCyw2up6tYZfIVhqP2zJzaXlbQ%3D"}],"group":"cf-nel","max_age":604800} content-type text/html;charset=UTF-8 cf-ray 86f18241bb5a4d9c-FRA alt-svc h3=":443"; ma=86400
GET H/1.1	200 OK	mtb-logo.svg resources.mtb.com/Assets/img/	2 KB 3 KB	118ms 118ms	Image image/svg+xml	24.75.29.77 LEVEL3
General Check archive.org Show headers Download Go to Show image Full URL https://resources.mtb.com/Assets/img/mtb-logo.svg Requested by Host: summer-bread-0a54.xvv.workers.dev URL: https://summer-bread-0a54.xvv.workers.dev/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 24.75.29.77 Buffalo, United States, ASN3356 (LEVEL3, US), Reverse DNS Software / Resource Hash 5f5b0d9f678fe446631a33a4cbbe891a01b0ed972143702e67ae6617367096ac Security Headers Name Value X-Frame-Options ALLOW-FROM https://mtb.com/ Request headers accept-language de-DE,de;q=0.9 Referer https://summer-bread-0a54.xvv.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 Response headers Date Thu, 04 Apr 2024 13:05:15 GMT Last-Modified Fri, 23 Feb 2024 07:33:42 GMT X-Srv B-STC-003 ETag "0f2a02a66da1:0" X-FRAME-OPTIONS ALLOW-FROM https://mtb.com/ Content-Type image/svg+xml Access-Control-Allow-Origin * Server-Timing dtSInfo;desc="0", dtRpid;desc="1479797980" Accept-Ranges bytes Content-Length 2039
GET H/1.1	200 OK	mtb-equalhousinglender.svg resources.mtb.com/Assets/img/	230 B 1 KB	220ms 105ms	Image image/svg+xml	24.75.29.77 LEVEL3
General Check archive.org Show headers Download Go to Show image Full URL https://resources.mtb.com/Assets/img/mtb-equalhousinglender.svg Requested by Host: summer-bread-0a54.xvv.workers.dev URL: https://summer-bread-0a54.xvv.workers.dev/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 24.75.29.77 Buffalo, United States, ASN3356 (LEVEL3, US), Reverse DNS Software / Resource Hash d58eb2802f72d0c6b1d944a1335e8fb914af44b51fe16097aad994c15b8cfbad Security Headers Name Value X-Frame-Options ALLOW-FROM https://mtb.com/ Request headers accept-language de-DE,de;q=0.9 Referer https://summer-bread-0a54.xvv.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 Response headers Date Thu, 04 Apr 2024 13:05:15 GMT Last-Modified Fri, 23 Feb 2024 07:33:42 GMT X-Srv B-STC-003 ETag "0f2a02a66da1:0" X-FRAME-OPTIONS ALLOW-FROM https://mtb.com/ Content-Type image/svg+xml Access-Control-Allow-Origin * Server-Timing dtSInfo;desc="0", dtRpid;desc="-1001812844" Accept-Ranges bytes Content-Length 230
GET H/1.1	200 OK	mtb-entrust.svg resources.mtb.com/Assets/img/	1 KB 2 KB	314ms 117ms	Image image/svg+xml	24.75.29.77 LEVEL3
General Check archive.org Show headers Download Go to Show image Full URL https://resources.mtb.com/Assets/img/mtb-entrust.svg Requested by Host: summer-bread-0a54.xvv.workers.dev URL: https://summer-bread-0a54.xvv.workers.dev/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 24.75.29.77 Buffalo, United States, ASN3356 (LEVEL3, US), Reverse DNS Software / Resource Hash b2ef3bd17aa6bc2daa7b1209f7848b30c64f3068e43162b09a216639ab430ce5 Security Headers Name Value X-Frame-Options ALLOW-FROM https://mtb.com/ Request headers accept-language de-DE,de;q=0.9 Referer https://summer-bread-0a54.xvv.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 Response headers Date Thu, 04 Apr 2024 13:05:15 GMT Last-Modified Fri, 23 Feb 2024 07:33:42 GMT X-Srv B-STC-003 ETag "0f2a02a66da1:0" X-FRAME-OPTIONS ALLOW-FROM https://mtb.com/ Content-Type image/svg+xml Access-Control-Allow-Origin * Server-Timing dtSInfo;desc="0", dtRpid;desc="844115835" Accept-Ranges bytes Content-Length 1349
GET H/1.1	200 OK	js.mtb Show response resources.mtb.com/r/simple-layout-responsive/	315 KB 102 KB	1079ms 123ms	Script text/javascript	24.75.29.77 LEVEL3
General Check archive.org Show headers Download Go to Full URL https://resources.mtb.com/r/simple-layout-responsive/js.mtb?v=11242021100000 Requested by Host: summer-bread-0a54.xvv.workers.dev URL: https://summer-bread-0a54.xvv.workers.dev/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 24.75.29.77 Buffalo, United States, ASN3356 (LEVEL3, US), Reverse DNS Software / Resource Hash 6ef98ef294d03000d904d5f868598dc98667a0d00338cee40b3080a9d725d1cd Security Headers Name Value X-Frame-Options ALLOW-FROM https://mtb.com/ Request headers Referer https://summer-bread-0a54.xvv.workers.dev/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers Cteonnt-Length 322405 Date Thu, 04 Apr 2024 13:05:15 GMT Content-Encoding gzip Last-Modified Thu, 04 Apr 2024 13:05:14 GMT X-Srv B-STC-003 ETag "1712235915:dtagent10285240307101407S3u4" Vary User-Agent X-FRAME-OPTIONS ALLOW-FROM https://mtb.com/ Content-Type text/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control private Transfer-Encoding chunked Server-Timing dtSInfo;desc="0", dtRpid;desc="1995559069" Expires Fri, 04 Apr 2025 13:05:15 GMT
GET H3	200	kessel-client-prod.js Show response summer-bread-0a54.xvv.workers.dev/Assets/js/	37 KB 8 KB	31ms 31ms	Script text/html	172.67.161.144 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://summer-bread-0a54.xvv.workers.dev/Assets/js/kessel-client-prod.js Requested by Host: summer-bread-0a54.xvv.workers.dev URL: https://summer-bread-0a54.xvv.workers.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.161.144 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fc5a6e6097664e74426d2662e0d5c1fc9ee5e662ef41982145ac1326ed740e09 Request headers accept-language de-DE,de;q=0.9 Referer https://summer-bread-0a54.xvv.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 Response headers date Thu, 04 Apr 2024 13:05:14 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v5Y0Zl37dGUs3btytUJtMTIRqLrs1Q1s%2BQzP9qGcyyM96DFLWzKYWs%2BJ6pRjnKn1l2T0z6E4IaIcQqdAUvomIVQ71sl22JgTjJAp8xHjuRgBTst4T1XDAYHvupJrQ9mP2QCgdBjKfJAOqloQQeT7p2IM6pg%3D"}],"group":"cf-nel","max_age":604800} content-type text/html;charset=UTF-8 cf-ray 86f18241bb5c4d9c-FRA alt-svc h3=":443"; ma=86400
GET H3	200	kessel-help.js Show response summer-bread-0a54.xvv.workers.dev/Assets/scripts/	37 KB 8 KB	32ms 32ms	Script text/html	172.67.161.144 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://summer-bread-0a54.xvv.workers.dev/Assets/scripts/kessel-help.js Requested by Host: summer-bread-0a54.xvv.workers.dev URL: https://summer-bread-0a54.xvv.workers.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.161.144 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fc5a6e6097664e74426d2662e0d5c1fc9ee5e662ef41982145ac1326ed740e09 Request headers accept-language de-DE,de;q=0.9 Referer https://summer-bread-0a54.xvv.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 Response headers date Thu, 04 Apr 2024 13:05:14 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4wAnMAtpVhVBzbwQhBYbdxFtJlVXcuDflMHufHiGYkGbj5mMN5uSRMGsM6lBXvvf6RIpV1u435rMAMO9SBWIiY3ZU1Y%2FT4YieFcnzGsRrVv5TmgQq2ZFQbrXheTzvDWE7Bynl0xtYQhcUgcas3BPj%2BiCUis%3D"}],"group":"cf-nel","max_age":604800} content-type text/html;charset=UTF-8 cf-ray 86f18241bb5e4d9c-FRA alt-svc h3=":443"; ma=86400
GET H3	200	Index.js Show response summer-bread-0a54.xvv.workers.dev/Assets/scripts/Login/	37 KB 8 KB	33ms 33ms	Script text/html	172.67.161.144 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://summer-bread-0a54.xvv.workers.dev/Assets/scripts/Login/Index.js Requested by Host: summer-bread-0a54.xvv.workers.dev URL: https://summer-bread-0a54.xvv.workers.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.161.144 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fc5a6e6097664e74426d2662e0d5c1fc9ee5e662ef41982145ac1326ed740e09 Request headers accept-language de-DE,de;q=0.9 Referer https://summer-bread-0a54.xvv.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 Response headers date Thu, 04 Apr 2024 13:05:14 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=45%2Fl2xeeScTAgHEJc5k%2FkNKLcOZ1%2BQYQD3TKnXePPwyi5TaNWeHXDDWeOFvyvJ9hwZntazUxSjg%2FA8s05qilxSZurcbZS4XoF0FlR%2BkbkwXhWu9YyrlOrKgd9mDdB0egZum804hVT5a0pE9AycAOb6c6UXQ%3D"}],"group":"cf-nel","max_age":604800} content-type text/html;charset=UTF-8 cf-ray 86f18241bb604d9c-FRA alt-svc h3=":443"; ma=86400
GET H/1.1	200 OK	mandtbaltoweb-book.woff resources.mtb.com/assets/fonts/	66 KB 67 KB	308ms 111ms	Font application/x-woff	24.75.29.77 LEVEL3
General Check archive.org Show headers Download Go to Full URL https://resources.mtb.com/assets/fonts/mandtbaltoweb-book.woff Requested by Host: resources.mtb.com URL: https://resources.mtb.com/r/simple-layout-responsive/css.mtb?v=11242021100000 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 24.75.29.77 Buffalo, United States, ASN3356 (LEVEL3, US), Reverse DNS Software / Resource Hash 4029a5a081992259f4e529190b49dbba893931da4e843dd203449f1b9a4509d2 Security Headers Name Value X-Frame-Options ALLOW-FROM https://mtb.com/ Request headers Referer https://resources.mtb.com/r/simple-layout-responsive/css.mtb?v=11242021100000 Origin https://summer-bread-0a54.xvv.workers.dev accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 Response headers Date Thu, 04 Apr 2024 13:05:15 GMT Last-Modified Fri, 23 Feb 2024 07:33:43 GMT X-Srv B-STC-003 ETag "03c33a12a66da1:0:dtagent10285240307101407S3u4" X-FRAME-OPTIONS ALLOW-FROM https://mtb.com/ Content-Type APPLICATION/X-WOFF Access-Control-Allow-Origin * Server-Timing dtSInfo;desc="0", dtRpid;desc="1682157994" Accept-Ranges bytes Content-Length 67671
GET H/1.1	200 OK	mandtbaltoweb-medium.woff resources.mtb.com/assets/fonts/	63 KB 63 KB	309ms 112ms	Font application/x-woff	24.75.29.77 LEVEL3
General Check archive.org Show headers Download Go to Full URL https://resources.mtb.com/assets/fonts/mandtbaltoweb-medium.woff Requested by Host: resources.mtb.com URL: https://resources.mtb.com/r/simple-layout-responsive/css.mtb?v=11242021100000 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 24.75.29.77 Buffalo, United States, ASN3356 (LEVEL3, US), Reverse DNS Software / Resource Hash b391b55f950528937beee7687717a4aef81196817834f1c93b099713ff738fbc Security Headers Name Value X-Frame-Options ALLOW-FROM https://mtb.com/ Request headers Referer https://resources.mtb.com/r/simple-layout-responsive/css.mtb?v=11242021100000 Origin https://summer-bread-0a54.xvv.workers.dev accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 Response headers Date Thu, 04 Apr 2024 13:05:15 GMT Last-Modified Fri, 23 Feb 2024 07:33:43 GMT X-Srv B-STC-003 ETag "03c33a12a66da1:0:dtagent10285240307101407S3u4" X-FRAME-OPTIONS ALLOW-FROM https://mtb.com/ Content-Type APPLICATION/X-WOFF Access-Control-Allow-Origin * Server-Timing dtSInfo;desc="0", dtRpid;desc="-1640122344" Accept-Ranges bytes Content-Length 64318
GET H2	200	favicon.ico asset.mtb.com/Documents/html/homepage/	15 KB 15 KB	60ms 9ms	Other image/x-icon	2600:9000:26e8:da00:b:2146:1340:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://asset.mtb.com/Documents/html/homepage/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:26e8:da00:b:2146:1340:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache / Resource Hash acfa0cc8b42493333d9032c79e4d91d7bbdd40995a283a3945075da6fb2f3cfb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://summer-bread-0a54.xvv.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 Response headers x-dispatcher dispatcher2useast1-28503851 strict-transport-security max-age=31536000; includeSubdomains; preload content-encoding gzip x-content-type-options nosniff date Thu, 04 Apr 2024 12:58:08 GMT via 1.1 2a1069adbc6a1208306ee3de10fe9952.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P10 age 524 x-vhost publish x-cache Hit from cloudfront content-disposition inline content-length 14862 last-modified Wed, 04 May 2022 18:18:59 GMT server Apache etag "3dce-5de33a8b9cac0-gzip" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/x-icon cache-control max-age=3600, no-cache="set-cookie" permissions-policy browsing-topics=() accept-ranges bytes x-amz-cf-id Txvoy51pR7j4EQ3On-datJrRFzmrReo1otUAUcoKCSlQylxh3sYRKQ==

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: M&T Bank (Banking)

53 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| YrJe object| _O string| APPID object| List object| s function| Hashtable function| startsWith function| DomDataCollection function| IE_FingerPrint function| Mozilla_FingerPrint function| Opera_FingerPrint function| Timer function| getRandomPort undefined| ProxyCollector function| BlackberryLocationCollector function| detectFields undefined| SEP undefined| PAIR undefined| DEV function| FingerPrint function| urlEncode function| encode_deviceprint function| decode_deviceprint function| post_deviceprint function| post_fingerprints function| add_deviceprint function| form_add_data function| form_add_deviceprint undefined| HTML5 undefined| BLACKBERRY undefined| UNDEFINED undefined| GEO_LOCATION_DEFAULT_STRUCT undefined| geoLocator undefined| geoLocatorStatus function| detectDeviceCollectionAPIMode function| init function| startCollection function| stopCollection function| getGeolocationStruct function| HTML5LocationCollector undefined| UIEventCollector function| UIEvent function| InteractionElement function| UIElementList function| activeXDetect function| stripIllegalChars function| stripFullPath undefined| BrowserDetect function| convertTimestampToGMT function| getTimestampInMillis function| debug function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://summer-bread-0a54.xvv.workers.dev/(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://resources.mtb.com/r/simple-layout-responsive/js.mtb?v=11242021100000, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

asset.mtb.com
resources.mtb.com
summer-bread-0a54.xvv.workers.dev
172.67.161.144
24.75.29.77
2600:9000:26e8:da00:b:2146:1340:93a1
4029a5a081992259f4e529190b49dbba893931da4e843dd203449f1b9a4509d2
58e1f9b6898a00101a5241e6524fca06fbab5abc06f1b0b52e4c0a6ceae70bf8
5f5b0d9f678fe446631a33a4cbbe891a01b0ed972143702e67ae6617367096ac
6ef98ef294d03000d904d5f868598dc98667a0d00338cee40b3080a9d725d1cd
acfa0cc8b42493333d9032c79e4d91d7bbdd40995a283a3945075da6fb2f3cfb
b2ef3bd17aa6bc2daa7b1209f7848b30c64f3068e43162b09a216639ab430ce5
b391b55f950528937beee7687717a4aef81196817834f1c93b099713ff738fbc
d58eb2802f72d0c6b1d944a1335e8fb914af44b51fe16097aad994c15b8cfbad
fc5a6e6097664e74426d2662e0d5c1fc9ee5e662ef41982145ac1326ed740e09