weepworknow.work.gd Open in urlscan Pro
185.209.162.219 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://weepworknow.work.gd/home.html?qj1loXOqSf4gc3aCFxBWxYI69ENuOWthDjwXvJECKW8XyjLOiKmHC9hm0Wmpwf2GpIprsdeh7426c5AcXQUxBS...
Submission: On March 15 via api (March 15th 2023, 6:33:43 pm UTC) from US — Scanned from US

Summary HTTP 14 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 14 HTTP transactions. The main IP is 185.209.162.219, located in Ede, Netherlands and belongs to HOSTING-SOLUTIONS, US. The main domain is weepworknow.work.gd.
TLS certificate: Issued by R3 on March 13th 2023. Valid for: 3 months.

This is the only time weepworknow.work.gd was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: M&T Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
9	185.209.162.219 185.209.162.219	14576 (HOSTING-S...) (HOSTING-SOLUTIONS)
3	2620:0:890::100 2620:0:890::100	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:acf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	4

9 185.209.162.219 (Ede, Netherlands)

ASN14576 (HOSTING-SOLUTIONS, US)

weepworknow.work.gd	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:0:890::100 (United States)

ASN54113 (FASTLY, US)

datacssjs.web.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	work.gd weepworknow.work.gd	170 KB
3	web.app datacssjs.web.app	54 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 784 stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2326	29 KB
14	3

	Domain	Requested by
9	weepworknow.work.gd	weepworknow.work.gd
3	datacssjs.web.app	weepworknow.work.gd
1	stackpath.bootstrapcdn.com	weepworknow.work.gd
1	maxcdn.bootstrapcdn.com	weepworknow.work.gd
14	4

This site contains links to these domains. Also see Links.

Domain
www.mtb.com
onlinebanking.mtb.com
www3.mtb.com
asset.mtb.com
mtb.com

Subject Issuer	Validity	Valid
weepworknow.work.gd R3	`2023-03-13` - `2023-06-11`	3 months	crt.sh
web.app GTS CA 1D4	`2023-03-06` - `2023-06-04`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-12-30` - `2023-12-30`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://weepworknow.work.gd/home.html?qj1loXOqSf4gc3aCFxBWxYI69ENuOWthDjwXvJECKW8XyjLOiKmHC9hm0Wmpwf2GpIprsdeh7426c5AcXQUxBSfyZvUqkqO8LMw2Yqrn1SJo4WK9Ah5gBb4lBf3ghmpqmWOS3=
Frame ID: E3B4F8046C1848079C3D497A72DA927A
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Welcome to Online Banking | M&T Bank

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

75 %
IPv6

3
Domains

4
Subdomains

4
IPs

2
Countries

252 kB
Transfer

667 kB
Size

0
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://www.mtb.com/home-page

Search URL Search Domain Scan URL

URL: https://onlinebanking.mtb.com/Login/LoginHelp
Title: Help with User ID or Passcode

Search URL Search Domain Scan URL

URL: https://onlinebanking.mtb.com/Enrollment/Enroll
Title: Enroll Now

Search URL Search Domain Scan URL

URL: https://www3.mtb.com/personal-banking/online-mobile-services
Title: Get Started Guide

Search URL Search Domain Scan URL

URL: https://www.mtb.com/olbsecurity
Title: Security Assistance

Search URL Search Domain Scan URL

URL: https://www3.mtb.com/homepage/explore-the-m-and-t-bank-help-center/digital-services-agreement.html
Title: Digital Service Agreement

Search URL Search Domain Scan URL

URL: https://asset.mtb.com/Documents/html/ESign.htm
Title: ESign Agreement

Search URL Search Domain Scan URL

URL: https://mtb.com/olb-accessibility
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://www.mtb.com/olb-personalsite
Title: mtb.com

Search URL Search Domain Scan URL

URL: https://www.mtb.com/help-center/policies/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.mtb.com/privacy
Title: Privacy

Search URL Search Domain Scan URL

URL: https://www.mtb.com/equalhousinglender

Search URL Search Domain Scan URL

URL: https://www.mtb.com/olb-entrust

Search URL Search Domain Scan URL

URL: https://www.mtb.com/fdic
Title: Member FDIC

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request home.html Show response
weepworknow.work.gd/ 8 KB
3 KB 393ms
99ms Document
text/html 185.209.162.219
HOSTING-SOLUTIONS

General

Check archive.org

Show headers Download Go to

Full URL: https://weepworknow.work.gd/home.html?qj1loXOqSf4gc3aCFxBWxYI69ENuOWthDjwXvJECKW8XyjLOiKmHC9hm0Wmpwf2GpIprsdeh7426c5AcXQUxBSfyZvUqkqO8LMw2Yqrn1SJo4WK9Ah5gBb4lBf3ghmpqmWOS3=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.209.162.219 Ede, Netherlands, ASN14576 (HOSTING-SOLUTIONS, US),
Reverse DNS
Software: nginx /
Resource Hash: 1d4ff8ac7d7a30a94bb3ce8dd10f6b297912bd4cafecacf1de60ec41179e3177

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=315360000
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Wed, 15 Mar 2023 18:33:37 GMT
ETag: W/"640f46db-1ebc"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Last-Modified: Mon, 13 Mar 2023 15:52:59 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H/1.1 200
OK css.mtb.css
weepworknow.work.gd/mtb/ 251 KB
28 KB 204ms
201ms Stylesheet
text/css 185.209.162.219
HOSTING-SOLUTIONS

General

Check archive.org

Show headers Download Go to

Full URL: https://weepworknow.work.gd/mtb/css.mtb.css
Requested by: Host: weepworknow.work.gd
URL: https://weepworknow.work.gd/home.html?qj1loXOqSf4gc3aCFxBWxYI69ENuOWthDjwXvJECKW8XyjLOiKmHC9hm0Wmpwf2GpIprsdeh7426c5AcXQUxBSfyZvUqkqO8LMw2Yqrn1SJo4WK9Ah5gBb4lBf3ghmpqmWOS3=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.209.162.219 Ede, Netherlands, ASN14576 (HOSTING-SOLUTIONS, US),
Reverse DNS
Software: nginx /
Resource Hash: 24f0d95fa34870957472207f3bd3912609f09d6895068bc4a4369a52069162a2

Request headers

accept-language: en-US,en;q=0.9
Referer: https://weepworknow.work.gd/home.html?qj1loXOqSf4gc3aCFxBWxYI69ENuOWthDjwXvJECKW8XyjLOiKmHC9hm0Wmpwf2GpIprsdeh7426c5AcXQUxBSfyZvUqkqO8LMw2Yqrn1SJo4WK9Ah5gBb4lBf3ghmpqmWOS3=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 15 Mar 2023 18:33:37 GMT
Content-Encoding: gzip
Last-Modified: Mon, 13 Mar 2023 15:53:09 GMT
Server: nginx
ETag: W/"640f46e5-3ea32"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=315360000
Connection: keep-alive
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK mtb-logo.svg
weepworknow.work.gd/mtb/ 2 KB
1 KB 305ms
98ms Image
image/svg+xml 185.209.162.219
HOSTING-SOLUTIONS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://weepworknow.work.gd/mtb/mtb-logo.svg
Requested by: Host: weepworknow.work.gd
URL: https://weepworknow.work.gd/home.html?qj1loXOqSf4gc3aCFxBWxYI69ENuOWthDjwXvJECKW8XyjLOiKmHC9hm0Wmpwf2GpIprsdeh7426c5AcXQUxBSfyZvUqkqO8LMw2Yqrn1SJo4WK9Ah5gBb4lBf3ghmpqmWOS3=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.209.162.219 Ede, Netherlands, ASN14576 (HOSTING-SOLUTIONS, US),
Reverse DNS
Software: nginx /
Resource Hash: 5f5b0d9f678fe446631a33a4cbbe891a01b0ed972143702e67ae6617367096ac

Request headers

accept-language: en-US,en;q=0.9
Referer: https://weepworknow.work.gd/home.html?qj1loXOqSf4gc3aCFxBWxYI69ENuOWthDjwXvJECKW8XyjLOiKmHC9hm0Wmpwf2GpIprsdeh7426c5AcXQUxBSfyZvUqkqO8LMw2Yqrn1SJo4WK9Ah5gBb4lBf3ghmpqmWOS3=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 15 Mar 2023 18:33:37 GMT
Content-Encoding: gzip
Last-Modified: Mon, 13 Mar 2023 15:53:11 GMT
Server: nginx
ETag: W/"640f46e7-7f7"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: max-age=315360000
Connection: keep-alive
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK mtb-equalhousinglender.svg
weepworknow.work.gd/mtb/ 230 B
538 B 293ms
98ms Image
image/svg+xml 185.209.162.219
HOSTING-SOLUTIONS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://weepworknow.work.gd/mtb/mtb-equalhousinglender.svg
Requested by: Host: weepworknow.work.gd
URL: https://weepworknow.work.gd/home.html?qj1loXOqSf4gc3aCFxBWxYI69ENuOWthDjwXvJECKW8XyjLOiKmHC9hm0Wmpwf2GpIprsdeh7426c5AcXQUxBSfyZvUqkqO8LMw2Yqrn1SJo4WK9Ah5gBb4lBf3ghmpqmWOS3=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.209.162.219 Ede, Netherlands, ASN14576 (HOSTING-SOLUTIONS, US),
Reverse DNS
Software: nginx /
Resource Hash: d58eb2802f72d0c6b1d944a1335e8fb914af44b51fe16097aad994c15b8cfbad

Request headers

accept-language: en-US,en;q=0.9
Referer: https://weepworknow.work.gd/home.html?qj1loXOqSf4gc3aCFxBWxYI69ENuOWthDjwXvJECKW8XyjLOiKmHC9hm0Wmpwf2GpIprsdeh7426c5AcXQUxBSfyZvUqkqO8LMw2Yqrn1SJo4WK9Ah5gBb4lBf3ghmpqmWOS3=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 15 Mar 2023 18:33:37 GMT
Last-Modified: Mon, 13 Mar 2023 15:53:11 GMT
Server: nginx
ETag: "640f46e7-e6"
Content-Type: image/svg+xml
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 230
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK mtb-entrust.svg
weepworknow.work.gd/mtb/ 1 KB
1 KB 389ms
98ms Image
image/svg+xml 185.209.162.219
HOSTING-SOLUTIONS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://weepworknow.work.gd/mtb/mtb-entrust.svg
Requested by: Host: weepworknow.work.gd
URL: https://weepworknow.work.gd/home.html?qj1loXOqSf4gc3aCFxBWxYI69ENuOWthDjwXvJECKW8XyjLOiKmHC9hm0Wmpwf2GpIprsdeh7426c5AcXQUxBSfyZvUqkqO8LMw2Yqrn1SJo4WK9Ah5gBb4lBf3ghmpqmWOS3=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.209.162.219 Ede, Netherlands, ASN14576 (HOSTING-SOLUTIONS, US),
Reverse DNS
Software: nginx /
Resource Hash: b2ef3bd17aa6bc2daa7b1209f7848b30c64f3068e43162b09a216639ab430ce5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://weepworknow.work.gd/home.html?qj1loXOqSf4gc3aCFxBWxYI69ENuOWthDjwXvJECKW8XyjLOiKmHC9hm0Wmpwf2GpIprsdeh7426c5AcXQUxBSfyZvUqkqO8LMw2Yqrn1SJo4WK9Ah5gBb4lBf3ghmpqmWOS3=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 15 Mar 2023 18:33:37 GMT
Content-Encoding: gzip
Last-Modified: Mon, 13 Mar 2023 15:53:11 GMT
Server: nginx
ETag: W/"640f46e7-545"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: max-age=315360000
Connection: keep-alive
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery-3.2.1.slim.min.js Show response
datacssjs.web.app/ 68 KB
21 KB 245ms
30ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://datacssjs.web.app/jquery-3.2.1.slim.min.js

Requested by

Host: weepworknow.work.gd
URL: https://weepworknow.work.gd/home.html?qj1loXOqSf4gc3aCFxBWxYI69ENuOWthDjwXvJECKW8XyjLOiKmHC9hm0Wmpwf2GpIprsdeh7426c5AcXQUxBSfyZvUqkqO8LMw2Yqrn1SJo4WK9Ah5gBb4lBf3ghmpqmWOS3=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

91a04a5dfe501d54af8a59b942495bd7ab26bb811ab34f460115fc0267f825f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://weepworknow.work.gd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-served-by: cache-nyc-kteb1890041-NYC
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 15 Mar 2023 18:33:37 GMT
last-modified: Wed, 09 Nov 2022 15:39:42 GMT
x-timer: S1678905217.327035,VS0,VE1
etag: "fa706d606bcc2f3394fa3f849918eac4389e95b120b49ed8910203678e8a0656-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 21611
x-cache-hits: 1

GET
H2 200 popper.min.js Show response
datacssjs.web.app/ 19 KB
6 KB 243ms
29ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://datacssjs.web.app/popper.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

5614d21225b2e012e3765c1b32fba0b8762bcecd8863c8705c1bcc0d03ec19de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://weepworknow.work.gd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-served-by: cache-nyc-kteb1890041-NYC
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 15 Mar 2023 18:33:37 GMT
last-modified: Wed, 09 Nov 2022 15:39:42 GMT
x-timer: S1678905217.327034,VS0,VE1
etag: "246703e1826a7c8cbd9eb918f3d97aa6bfaf640d7d745b43ebe24b69b6f5d984-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 6162
x-cache-hits: 1

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 48 KB
14 KB 249ms
40ms Script
application/javascript 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://weepworknow.work.gd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 15 Mar 2023 18:33:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 894
age: 10725939
cdn-cachedat: 06/22/2022 17:36:12
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:04 GMT
cdn-proxyver: 1.02
cdn-requestpullcode: 200
server: cloudflare
etag: W/"14d449eb8876fa55e1ef3c2cc52b0c17"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: bcadf6a6697ab6999efcbb204396ecc2
timing-allow-origin: *
cdn-requestcountrycode: US
cdn-status: 200
cf-ray: 7a86d8883adad157-BUF
cdn-requestpullsuccess: True

GET
H2 200 jquery.min.js Show response
datacssjs.web.app/ 84 KB
26 KB 251ms
39ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://datacssjs.web.app/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

fdce77a6d0053f32d231518a84a71bcab5c86045ed52369da00b89d4284aef46

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://weepworknow.work.gd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-served-by: cache-nyc-kteb1890041-NYC
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 15 Mar 2023 18:33:37 GMT
last-modified: Wed, 09 Nov 2022 15:39:42 GMT
x-timer: S1678905217.327116,VS0,VE1
etag: "35bb3076b37fd83820167e32b562f37457418bf46165bedc0e80941c9fb68c4f-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 26924
x-cache-hits: 1

GET
H2 200 bootstrap.min.js Show response
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 50 KB
15 KB 253ms
45ms Script
application/javascript 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://weepworknow.work.gd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Wed, 15 Mar 2023 18:33:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 845
age: 10740032
cdn-cachedat: 07/13/2022 17:30:46
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:06 GMT
cdn-proxyver: 1.02
cdn-requestpullcode: 200
server: cloudflare
etag: W/"67176c242e1bdc20603c878dee836df3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 7bde012c47e0eeb67993e8e75d655340
timing-allow-origin: *
cdn-requestcountrycode: US
cdn-status: 200
cf-ray: 7a86d8883c9bd14f-BUF
cdn-requestpullsuccess: True

GET
H/1.1 200
OK min2.js Show response
weepworknow.work.gd/ 4 KB
1 KB 283ms
99ms Script
application/javascript 185.209.162.219
HOSTING-SOLUTIONS

General

Check archive.org

Show headers Download Go to

Full URL: https://weepworknow.work.gd/min2.js
Requested by: Host: weepworknow.work.gd
URL: https://weepworknow.work.gd/home.html?qj1loXOqSf4gc3aCFxBWxYI69ENuOWthDjwXvJECKW8XyjLOiKmHC9hm0Wmpwf2GpIprsdeh7426c5AcXQUxBSfyZvUqkqO8LMw2Yqrn1SJo4WK9Ah5gBb4lBf3ghmpqmWOS3=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.209.162.219 Ede, Netherlands, ASN14576 (HOSTING-SOLUTIONS, US),
Reverse DNS
Software: nginx /
Resource Hash: e0731b9d34d0faa917438774d6e82cff05bb544cd8d5c0863a21a729a2b51a8d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://weepworknow.work.gd/home.html?qj1loXOqSf4gc3aCFxBWxYI69ENuOWthDjwXvJECKW8XyjLOiKmHC9hm0Wmpwf2GpIprsdeh7426c5AcXQUxBSfyZvUqkqO8LMw2Yqrn1SJo4WK9Ah5gBb4lBf3ghmpqmWOS3=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 15 Mar 2023 18:33:37 GMT
Content-Encoding: gzip
Last-Modified: Mon, 13 Mar 2023 15:52:59 GMT
Server: nginx
ETag: W/"640f46db-e07"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=315360000
Connection: keep-alive
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK mandtbaltoweb-book.woff
weepworknow.work.gd/mtb/ 66 KB
66 KB 203ms
201ms Font
font/woff 185.209.162.219
HOSTING-SOLUTIONS

General

Check archive.org

Show headers Download Go to

Full URL: https://weepworknow.work.gd/mtb/mandtbaltoweb-book.woff
Requested by: Host: weepworknow.work.gd
URL: https://weepworknow.work.gd/mtb/css.mtb.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.209.162.219 Ede, Netherlands, ASN14576 (HOSTING-SOLUTIONS, US),
Reverse DNS
Software: nginx /
Resource Hash: 4029a5a081992259f4e529190b49dbba893931da4e843dd203449f1b9a4509d2

Request headers

Referer: https://weepworknow.work.gd/mtb/css.mtb.css
Origin: https://weepworknow.work.gd
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 15 Mar 2023 18:33:37 GMT
Last-Modified: Mon, 13 Mar 2023 15:53:09 GMT
Server: nginx
ETag: "640f46e5-10857"
Content-Type: font/woff
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 67671
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK mandtpg-iconfont.woff
weepworknow.work.gd/mtb/ 5 KB
5 KB 109ms
98ms Font
font/woff 185.209.162.219
HOSTING-SOLUTIONS

General

Check archive.org

Show headers Download Go to

Full URL: https://weepworknow.work.gd/mtb/mandtpg-iconfont.woff
Requested by: Host: weepworknow.work.gd
URL: https://weepworknow.work.gd/mtb/css.mtb.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.209.162.219 Ede, Netherlands, ASN14576 (HOSTING-SOLUTIONS, US),
Reverse DNS
Software: nginx /
Resource Hash: 108d16421ae2ff7fc5157d507dc5b1bf7f62140ba58cf3c723b1f2b7e74c21df

Request headers

Referer: https://weepworknow.work.gd/mtb/css.mtb.css
Origin: https://weepworknow.work.gd
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 15 Mar 2023 18:33:37 GMT
Last-Modified: Mon, 13 Mar 2023 15:53:10 GMT
Server: nginx
ETag: "640f46e6-12a8"
Content-Type: font/woff
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4776
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK mandtbaltoweb-medium.woff
weepworknow.work.gd/mtb/ 63 KB
63 KB 277ms
198ms Font
font/woff 185.209.162.219
HOSTING-SOLUTIONS

General

Check archive.org

Show headers Download Go to

Full URL: https://weepworknow.work.gd/mtb/mandtbaltoweb-medium.woff
Requested by: Host: weepworknow.work.gd
URL: https://weepworknow.work.gd/mtb/css.mtb.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.209.162.219 Ede, Netherlands, ASN14576 (HOSTING-SOLUTIONS, US),
Reverse DNS
Software: nginx /
Resource Hash: b391b55f950528937beee7687717a4aef81196817834f1c93b099713ff738fbc

Request headers

Referer: https://weepworknow.work.gd/mtb/css.mtb.css
Origin: https://weepworknow.work.gd
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 15 Mar 2023 18:33:37 GMT
Last-Modified: Mon, 13 Mar 2023 15:53:10 GMT
Server: nginx
ETag: "640f46e6-fb3e"
Content-Type: font/woff
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 64318
Expires: Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: M&T Bank (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

datacssjs.web.app
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
weepworknow.work.gd
185.209.162.219
2606:4700::6812:acf
2606:4700::6812:bcf
2620:0:890::100
108d16421ae2ff7fc5157d507dc5b1bf7f62140ba58cf3c723b1f2b7e74c21df
1d4ff8ac7d7a30a94bb3ce8dd10f6b297912bd4cafecacf1de60ec41179e3177
24f0d95fa34870957472207f3bd3912609f09d6895068bc4a4369a52069162a2
4029a5a081992259f4e529190b49dbba893931da4e843dd203449f1b9a4509d2
5614d21225b2e012e3765c1b32fba0b8762bcecd8863c8705c1bcc0d03ec19de
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
5f5b0d9f678fe446631a33a4cbbe891a01b0ed972143702e67ae6617367096ac
91a04a5dfe501d54af8a59b942495bd7ab26bb811ab34f460115fc0267f825f1
b2ef3bd17aa6bc2daa7b1209f7848b30c64f3068e43162b09a216639ab430ce5
b391b55f950528937beee7687717a4aef81196817834f1c93b099713ff738fbc
d58eb2802f72d0c6b1d944a1335e8fb914af44b51fe16097aad994c15b8cfbad
e0731b9d34d0faa917438774d6e82cff05bb544cd8d5c0863a21a729a2b51a8d
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
fdce77a6d0053f32d231518a84a71bcab5c86045ed52369da00b89d4284aef46

weepworknow.work.gd Open in urlscan Pro 185.209.162.219 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

75 %IPv6

3 Domains

4 Subdomains

4 IPs

2 Countries

252 kBTransfer

667 kBSize

0 Cookies

14 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Indicators

weepworknow.work.gd Open in urlscan Pro
185.209.162.219 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

75 %
IPv6

3
Domains

4
Subdomains

4
IPs

2
Countries

252 kB
Transfer

667 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!