www.user-securepass.com Open in urlscan Pro
170.64.142.67 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.user-securepass.com/
Effective URL:
https://www.user-securepass.com/main.php
Submission: On April 20 via automatic, source certstream-suspicious (April 20th 2023, 8:41:46 am UTC) — Scanned from AU

Summary HTTP 23 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 23 HTTP transactions. The main IP is 170.64.142.67, located in Sydney, Australia and belongs to DIGITALOCEAN-ASN, US. The main domain is www.user-securepass.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 20th 2023. Valid for: 3 months.

This is the only time www.user-securepass.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: M&T Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 10	170.64.142.67 170.64.142.67	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	54.192.150.35 54.192.150.35	16509 (AMAZON-02) (AMAZON-02)
2	54.192.150.67 54.192.150.67	16509 (AMAZON-02) (AMAZON-02)
2	13.33.33.69 13.33.33.69	16509 (AMAZON-02) (AMAZON-02)
2	13.224.250.95 13.224.250.95	16509 (AMAZON-02) (AMAZON-02)
23	6

10 170.64.142.67 (Sydney, Australia) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

www.user-securepass.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.192.150.35 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-192-150-35.sin2.r.cloudfront.net

www3.mtb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.192.150.67 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-192-150-67.sin2.r.cloudfront.net

1.a79ab95c1589a13f8a4cab612bc71f9f7.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.33.33.69 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-33-69.sin2.r.cloudfront.net

1.b406929acabac9b095f124c81bdfcf57f.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.224.250.95 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-250-95.sin52.r.cloudfront.net

1.c81358859121583b7adf2ace89cb39f44.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	user-securepass.com 1 redirects www.user-securepass.com	1 MB
2	c81358859121583b7adf2ace89cb39f44.com 1.c81358859121583b7adf2ace89cb39f44.com — Cisco Umbrella Rank: 34620	4 KB
2	b406929acabac9b095f124c81bdfcf57f.com 1.b406929acabac9b095f124c81bdfcf57f.com — Cisco Umbrella Rank: 34850	4 KB
2	a79ab95c1589a13f8a4cab612bc71f9f7.com 1.a79ab95c1589a13f8a4cab612bc71f9f7.com — Cisco Umbrella Rank: 34588	4 KB
1	mtb.com www3.mtb.com — Cisco Umbrella Rank: 236547	57 KB
23	5

	Domain	Requested by
10	www.user-securepass.com	1 redirects www.user-securepass.com
2	1.c81358859121583b7adf2ace89cb39f44.com	www.user-securepass.com 1.c81358859121583b7adf2ace89cb39f44.com
2	1.b406929acabac9b095f124c81bdfcf57f.com	www.user-securepass.com 1.b406929acabac9b095f124c81bdfcf57f.com
2	1.a79ab95c1589a13f8a4cab612bc71f9f7.com	www.user-securepass.com 1.a79ab95c1589a13f8a4cab612bc71f9f7.com
1	www3.mtb.com	www.user-securepass.com www3.mtb.com
23	5

This site contains no links.

Subject Issuer	Validity	Valid
user-securepass.com cPanel, Inc. Certification Authority	`2023-04-20` - `2023-07-19`	3 months	crt.sh
www.mtb.com Entrust Certification Authority - L1M	`2022-08-29` - `2023-06-02`	9 months	crt.sh
*.a79ab95c1589a13f8a4cab612bc71f9f7.com Sectigo RSA Domain Validation Secure Server CA	`2023-03-26` - `2024-04-04`	a year	crt.sh
*.b406929acabac9b095f124c81bdfcf57f.com Sectigo RSA Domain Validation Secure Server CA	`2023-04-02` - `2024-04-07`	a year	crt.sh
*.c81358859121583b7adf2ace89cb39f44.com Sectigo RSA Domain Validation Secure Server CA	`2023-04-02` - `2024-04-07`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://www.user-securepass.com/main.php
Frame ID: F330B6C9D93FD04C6F428C8924AA40BC
Requests: 18 HTTP requests in this frame

Frame: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Frame ID: 26F4861925BCC528CFF4A1975EA97B41
Requests: 2 HTTP requests in this frame

Frame: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Frame ID: 9AAA3274E25237885555ED64369F9112
Requests: 2 HTTP requests in this frame

Frame: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Frame ID: FC25E9C1BB2F97636F32A1F85730F118
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log in to M&T Online Banking or Commercial Treasury CenterNavigation Menu

Page URL History Show full URLs

https://www.user-securepass.com/ HTTP 302
https://www.user-securepass.com/main.php Page URL

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

<div class="[^"]*aem-Grid
/etc\.clientlibs/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

23
Requests

70 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

6
IPs

2
Countries

1272 kB
Transfer

1801 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.user-securepass.com/ HTTP 302
https://www.user-securepass.com/main.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request main.php Show response
www.user-securepass.com/
Redirect Chain

https://www.user-securepass.com/
https://www.user-securepass.com/main.php

59 KB
59 KB

117ms
117ms

Document
text/html

170.64.142.67
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.user-securepass.com/main.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 170.64.142.67 Sydney, Australia, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: c565fe1dd5bd3d44d700ff4f06150a131c9582dcae6f60a083e6cfdf0dd34b1f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Thu, 20 Apr 2023 08:41:38 GMT
Keep-Alive: timeout=5, max=99
Server: Apache
Transfer-Encoding: chunked

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Thu, 20 Apr 2023 08:41:38 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=100
Location: main.php
Pragma: no-cache
Server: Apache

GET
H2 200 clientlib-base.css
www3.mtb.com/etc.clientlibs/mtb-web/clientlibs/ 425 KB
57 KB 655ms
229ms Stylesheet
text/css 54.192.150.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www3.mtb.com/etc.clientlibs/mtb-web/clientlibs/clientlib-base.css

Requested by

Host: www.user-securepass.com
URL: https://www.user-securepass.com/main.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.150.35 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-150-35.sin2.r.cloudfront.net

Software

Apache /

Resource Hash

8e36f036be3313f66918b7f296388c199468b0ffb75d3f8908cd04f58d966964

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.user-securepass.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 20 Apr 2023 08:37:04 GMT
via: 1.1 998b911809b5181544e60111e0bda762.cloudfront.net (CloudFront)
x-amz-cf-pop: SIN2-C1
age: 648
x-vhost: publish
x-cache: Hit from cloudfront
content-disposition: inline
content-length: 57814
last-modified: Mon, 27 Mar 2023 20:18:46 GMT
server: Apache
etag: "6a323-5f7e773365580-gzip"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css;charset=utf-8
cache-control: max-age=3600, public, no-cache="set-cookie"
accept-ranges: bytes
x-amz-cf-id: dGlB8B1gL2TZlyPK_o4MbTaEV83JQWQipCl3UX1q7n-W3y5F7f_59Q==

GET
H/1.1 200
OK mtb_app_wbk.js Show response
www.user-securepass.com/css/ 242 KB
243 KB 293ms
100ms Script
application/javascript 170.64.142.67
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.user-securepass.com/css/mtb_app_wbk.js
Requested by: Host: www.user-securepass.com
URL: https://www.user-securepass.com/main.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 170.64.142.67 Sydney, Australia, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: b9b7a642f229db0bbc0a820e1eee063041d03ab631f868e8106c1aa1c4647b75

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.user-securepass.com/main.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Thu, 20 Apr 2023 08:41:39 GMT
Last-Modified: Wed, 15 Jun 2022 02:30:38 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 248194

GET
H/1.1 200
OK cdsession.js Show response
www.user-securepass.com/css/ 605 KB
605 KB 296ms
99ms Script
application/javascript 170.64.142.67
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.user-securepass.com/css/cdsession.js
Requested by: Host: www.user-securepass.com
URL: https://www.user-securepass.com/main.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 170.64.142.67 Sydney, Australia, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 302462d4283c45e7405dcaf5036c9f1e34982c47baaa0a39c2b45e6cb9a203f4

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.user-securepass.com/main.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Thu, 20 Apr 2023 08:41:39 GMT
Last-Modified: Wed, 15 Jun 2022 02:30:54 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 619717

GET
H/1.1 200
OK vendor.js Show response
www.user-securepass.com/css/ 236 KB
237 KB 297ms
99ms Script
application/javascript 170.64.142.67
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.user-securepass.com/css/vendor.js
Requested by: Host: www.user-securepass.com
URL: https://www.user-securepass.com/main.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 170.64.142.67 Sydney, Australia, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: c5bac5c06dfc6a8b1547af4e6dfa0d784f70db7c92cfe1e97c45e962f0283d0c

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.user-securepass.com/main.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Thu, 20 Apr 2023 08:41:39 GMT
Last-Modified: Wed, 15 Jun 2022 01:31:44 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 242127

GET
H/1.1 200
OK white%20logo.png
www.user-securepass.com/css/ 5 KB
5 KB 100ms
99ms Image
image/png 170.64.142.67
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.user-securepass.com/css/white%20logo.png
Requested by: Host: www.user-securepass.com
URL: https://www.user-securepass.com/main.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 170.64.142.67 Sydney, Australia, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 68d12e8086357835fc398c26ffc15a2ad73d6c1ceb930e545982149af754e652

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.user-securepass.com/main.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Thu, 20 Apr 2023 08:41:39 GMT
Last-Modified: Wed, 15 Jun 2022 02:25:30 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 4936

GET
H/1.1 200
OK equal-housing-lender-logo.png
www.user-securepass.com/css/ 1 KB
2 KB 99ms
99ms Image
image/png 170.64.142.67
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.user-securepass.com/css/equal-housing-lender-logo.png
Requested by: Host: www.user-securepass.com
URL: https://www.user-securepass.com/main.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 170.64.142.67 Sydney, Australia, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 46c43686825a8cb8bf832253977abfb4871e5d9014cb6912e8519c736a6253d3

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.user-securepass.com/main.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Thu, 20 Apr 2023 08:41:39 GMT
Last-Modified: Wed, 15 Jun 2022 02:27:38 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 1509

GET
H/1.1 200
OK fszullhwyai6bvj-desktop-720x816-update.jpeg
www.user-securepass.com/css/ 26 KB
26 KB 100ms
99ms Image
image/jpeg 170.64.142.67
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.user-securepass.com/css/fszullhwyai6bvj-desktop-720x816-update.jpeg
Requested by: Host: www.user-securepass.com
URL: https://www.user-securepass.com/main.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 170.64.142.67 Sydney, Australia, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: ed305c6fbe8bfbc0a34f339f2430f89e03d49cf628945a0c126896d96760f86c

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.user-securepass.com/main.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Thu, 20 Apr 2023 08:41:40 GMT
Last-Modified: Wed, 15 Jun 2022 02:36:50 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 26353

GET
H/1.1 200
OK fszullhwyai6bvj.jpeg
www.user-securepass.com/css/ 25 KB
25 KB 99ms
99ms Image
image/jpeg 170.64.142.67
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.user-securepass.com/css/fszullhwyai6bvj.jpeg
Requested by: Host: www.user-securepass.com
URL: https://www.user-securepass.com/main.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 170.64.142.67 Sydney, Australia, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: a06dcffedaadc56b236deaf03906e025341b8fe314430247de506bd37237d42e

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.user-securepass.com/main.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Thu, 20 Apr 2023 08:41:40 GMT
Last-Modified: Wed, 15 Jun 2022 02:37:36 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 25445

GET
BLOB 200
OK c06d04a1-ae51-462b-a046-8be86020f147
https://www.user-securepass.com/ 165 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.user-securepass.com/c06d04a1-ae51-462b-a046-8be86020f147
Requested by: Host: www.user-securepass.com
URL: https://www.user-securepass.com/main.php
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 25e521f17135f161c1f02f0555af227292ab009967c461380e3135c414f288e6

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Length: 169098
Content-Type

GET mandtbaltoweb-book.woff
www3.mtb.com/etc.clientlibs/mtb-web/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/ 0
0

GET mandtbaltoweb-light.woff
www3.mtb.com/etc.clientlibs/mtb-web/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/ 0
0

GET
H/1.1 200
OK chevron_down.8adc6731.svg
www.user-securepass.com/css/ 970 B
1 KB 100ms
99ms Image
image/svg+xml 170.64.142.67
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.user-securepass.com/css/chevron_down.8adc6731.svg
Requested by: Host: www.user-securepass.com
URL: https://www.user-securepass.com/main.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 170.64.142.67 Sydney, Australia, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 03cc12570299da2da582ed1f055f77f31f7d77899f1ada7ced1dfeea50068298

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.user-securepass.com/main.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Thu, 20 Apr 2023 08:41:40 GMT
Last-Modified: Wed, 15 Jun 2022 02:35:42 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 970

GET mandtbaltoweb-medium.woff
www3.mtb.com/etc.clientlibs/mtb-web/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/ 0
0

GET
DATA 200
OK truncated
/ 89 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 50e6072d26098d48004a30addeecabd5b22b91e5ccdf9dd86f96459783e3ac23

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/png

GET mandtbaltoweb-book.woff
www3.mtb.com/etc.clientlibs/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/ 0
0

GET mandtbaltoweb-light.woff
www3.mtb.com/etc.clientlibs/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/ 0
0

GET
H2 200 crossdomain.html Show response
1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/ Frame 26F4 221 B
557 B 609ms
198ms Document
text/html 54.192.150.67
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Requested by: Host: www.user-securepass.com
URL: https://www.user-securepass.com/css/cdsession.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.150.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-150-67.sin2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer: https://www.user-securepass.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 64081
content-length: 221
content-type: text/html
date: Wed, 19 Apr 2023 14:53:41 GMT
etag: "21e34cf6a03f570df49e212018a567d0"
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
via: 1.1 0676a5fe6935c768360b164abce6620e.cloudfront.net (CloudFront)
x-amz-cf-id: w_-HyMQGvOCmK4R1qgWRaPHLuGZun6SA_JuEL0IT7NGzZvO-nwYQ_A==
x-amz-cf-pop: SIN2-C1
x-amz-version-id: null
x-cache: Hit from cloudfront

GET
H2 200 crossdomain.html Show response
1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/ Frame 9AAA 221 B
555 B 610ms
195ms Document
text/html 13.33.33.69
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Requested by: Host: www.user-securepass.com
URL: https://www.user-securepass.com/css/cdsession.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.33.69 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-33-69.sin2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer: https://www.user-securepass.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 68625
content-length: 221
content-type: text/html
date: Wed, 19 Apr 2023 13:37:57 GMT
etag: "21e34cf6a03f570df49e212018a567d0"
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
via: 1.1 69eaf3b14624853f73e8b23e5e76f49e.cloudfront.net (CloudFront)
x-amz-cf-id: b8Q7qfa6UUduK5thCesC2e_dGulW3zvHNBodJVKLjfPgTCFLFvEccw==
x-amz-cf-pop: SIN2-P1
x-amz-version-id: null
x-cache: Hit from cloudfront

GET
H2 200 crossdomain.html Show response
1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/ Frame FC25 221 B
557 B 614ms
195ms Document
text/html 13.224.250.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Requested by: Host: www.user-securepass.com
URL: https://www.user-securepass.com/css/cdsession.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.250.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-250-95.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer: https://www.user-securepass.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 71767
content-length: 221
content-type: text/html
date: Wed, 19 Apr 2023 12:45:35 GMT
etag: "21e34cf6a03f570df49e212018a567d0"
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
via: 1.1 17d56a41c5d306f635a528df1fa752b8.cloudfront.net (CloudFront)
x-amz-cf-id: 6wybm2NEBYdUvHG6lx4OnCqcEaf3WMN0K_MKK-SWoOaUhQ1UxwYHnw==
x-amz-cf-pop: SIN52-C2
x-amz-version-id: null
x-cache: Hit from cloudfront

GET mandtbaltoweb-medium.woff
www3.mtb.com/etc.clientlibs/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/ 0
0

GET
H2 200 crossdomain2.12.0.5273.b96c35cc.min.js Show response
1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/ Frame 26F4 3 KB
3 KB 204ms
204ms Script
application/javascript 54.192.150.67
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by: Host: 1.a79ab95c1589a13f8a4cab612bc71f9f7.com
URL: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.150.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-150-67.sin2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id: null
date: Thu, 20 Apr 2023 06:31:18 GMT
via: 1.1 0676a5fe6935c768360b164abce6620e.cloudfront.net (CloudFront)
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
x-amz-cf-pop: SIN2-C1
age: 7824
etag: "9ee48a4da9c402e8a23ad085fb71f28f"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 3227
x-amz-cf-id: xYiEL3A0mngrj3SjpjDG635cLYA4ImFtr8cYnNgnvxO_EwgE_AUEbA==

GET
H2 200 crossdomain2.12.0.5273.b96c35cc.min.js Show response
1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/ Frame 9AAA 3 KB
3 KB 202ms
202ms Script
application/javascript 13.33.33.69
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by: Host: 1.b406929acabac9b095f124c81bdfcf57f.com
URL: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.33.69 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-33-69.sin2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id: null
date: Wed, 19 Apr 2023 14:53:41 GMT
via: 1.1 69eaf3b14624853f73e8b23e5e76f49e.cloudfront.net (CloudFront)
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
x-amz-cf-pop: SIN2-P1
age: 64081
etag: "9ee48a4da9c402e8a23ad085fb71f28f"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 3227
x-amz-cf-id: d0ZAoN0Ex-MXumx604gPs2-BzKhdkuc0EF_dhi1Q-60kz24X4kA_NA==

GET
H2 200 crossdomain2.12.0.5273.b96c35cc.min.js Show response
1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/ Frame FC25 3 KB
3 KB 201ms
201ms Script
application/javascript 13.224.250.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by: Host: 1.c81358859121583b7adf2ace89cb39f44.com
URL: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.250.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-250-95.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id: null
date: Wed, 19 Apr 2023 14:46:31 GMT
via: 1.1 17d56a41c5d306f635a528df1fa752b8.cloudfront.net (CloudFront)
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-C2
age: 64511
etag: "9ee48a4da9c402e8a23ad085fb71f28f"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 3227
x-amz-cf-id: StfDBuKjuzSvt3X7cYsMI3Tgclx9QH7w97N9CDct3p5WMRp7IqvV1g==

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www3.mtb.com
URL: https://www3.mtb.com/etc.clientlibs/mtb-web/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-book.woff

Domain: www3.mtb.com
URL: https://www3.mtb.com/etc.clientlibs/mtb-web/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-light.woff

Domain: www3.mtb.com
URL: https://www3.mtb.com/etc.clientlibs/mtb-web/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-medium.woff

Domain: www3.mtb.com
URL: https://www3.mtb.com/etc.clientlibs/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-book.woff

Domain: www3.mtb.com
URL: https://www3.mtb.com/etc.clientlibs/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-light.woff

Domain: www3.mtb.com
URL: https://www3.mtb.com/etc.clientlibs/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-medium.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: M&T Bank (Banking)

66 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.user-securepass.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 7cdb0b86578a5d3e48f049e8d1717952
.user-securepass.com/	1969-12-31 23:59:59	Name: cdContextId Value: 1
.user-securepass.com/	1970-01-20 19:58:36	Name: bmuid Value: 1681980100143-FDCE4E7E-01ED-4755-B6ED-8F3DB6BB081A
www.user-securepass.com/	1970-01-20 11:13:01	Name: cdSessionId Value: adcdb29d-dee3-4bc9-af0e-947eb989c6fa
.user-securepass.com/	1970-01-20 19:58:36	Name: cdSNum Value: 1681980100916-sjn0000456-9146c389-3e7f-476b-a7e6-50114b00a108

14 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://www.user-securepass.com/css/mtb_app_wbk.js Message: Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
rendering	warning	URL: https://www.user-securepass.com/css/mtb_app_wbk.js Message: Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
javascript	error	URL: https://www.user-securepass.com/main.php Message: Access to font at 'https://www3.mtb.com/etc.clientlibs/mtb-web/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-book.woff' from origin 'https://www.user-securepass.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www3.mtb.com/etc.clientlibs/mtb-web/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-book.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.user-securepass.com/main.php Message: Access to font at 'https://www3.mtb.com/etc.clientlibs/mtb-web/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-light.woff' from origin 'https://www.user-securepass.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www3.mtb.com/etc.clientlibs/mtb-web/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-light.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.user-securepass.com/main.php Message: Access to font at 'https://www3.mtb.com/etc.clientlibs/mtb-web/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-medium.woff' from origin 'https://www.user-securepass.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www3.mtb.com/etc.clientlibs/mtb-web/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-medium.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.user-securepass.com/main.php Message: Access to font at 'https://www3.mtb.com/etc.clientlibs/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-light.woff' from origin 'https://www.user-securepass.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www3.mtb.com/etc.clientlibs/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-light.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.user-securepass.com/main.php Message: Access to font at 'https://www3.mtb.com/etc.clientlibs/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-medium.woff' from origin 'https://www.user-securepass.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www3.mtb.com/etc.clientlibs/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-medium.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.user-securepass.com/main.php Message: Access to font at 'https://www3.mtb.com/etc.clientlibs/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-book.woff' from origin 'https://www.user-securepass.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www3.mtb.com/etc.clientlibs/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-book.woff Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1.a79ab95c1589a13f8a4cab612bc71f9f7.com
1.b406929acabac9b095f124c81bdfcf57f.com
1.c81358859121583b7adf2ace89cb39f44.com
www.user-securepass.com
www3.mtb.com
www3.mtb.com
13.224.250.95
13.33.33.69
170.64.142.67
54.192.150.35
54.192.150.67
03cc12570299da2da582ed1f055f77f31f7d77899f1ada7ced1dfeea50068298
0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6
25e521f17135f161c1f02f0555af227292ab009967c461380e3135c414f288e6
302462d4283c45e7405dcaf5036c9f1e34982c47baaa0a39c2b45e6cb9a203f4
46c43686825a8cb8bf832253977abfb4871e5d9014cb6912e8519c736a6253d3
50e6072d26098d48004a30addeecabd5b22b91e5ccdf9dd86f96459783e3ac23
68d12e8086357835fc398c26ffc15a2ad73d6c1ceb930e545982149af754e652
8e36f036be3313f66918b7f296388c199468b0ffb75d3f8908cd04f58d966964
9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622
a06dcffedaadc56b236deaf03906e025341b8fe314430247de506bd37237d42e
b9b7a642f229db0bbc0a820e1eee063041d03ab631f868e8106c1aa1c4647b75
c565fe1dd5bd3d44d700ff4f06150a131c9582dcae6f60a083e6cfdf0dd34b1f
c5bac5c06dfc6a8b1547af4e6dfa0d784f70db7c92cfe1e97c45e962f0283d0c
ed305c6fbe8bfbc0a34f339f2430f89e03d49cf628945a0c126896d96760f86c

www.user-securepass.com Open in urlscan Pro 170.64.142.67 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

23 Requests

70 %HTTPS

0 %IPv6

5 Domains

5 Subdomains

6 IPs

2 Countries

1272 kBTransfer

1801 kBSize

5 Cookies

0 Outgoing links

Page URL History

Redirected requests

23 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

66 JavaScript Global Variables

5 Cookies

14 Console Messages

Indicators

www.user-securepass.com Open in urlscan Pro
170.64.142.67 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

23
Requests

70 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

6
IPs

2
Countries

1272 kB
Transfer

1801 kB
Size

5
Cookies

23 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!