eduplus.sch.ng - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 192.3.137.194, located in Denver, United States and belongs to AS-COLOCROSSING, US. The main domain is eduplus.sch.ng.
TLS certificate: Issued by R3 on November 27th 2022. Valid for: 3 months.

This is the only time eduplus.sch.ng was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: M&T Bank (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1	192.3.137.194 192.3.137.194		36352 (AS-COLOCR...) (AS-COLOCROSSING)
1	2

1 192.3.137.194 (Denver, United States)

ASN36352 (AS-COLOCROSSING, US)
PTR: wgh13.wghservers.com

eduplus.sch.ng	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	eduplus.sch.ng eduplus.sch.ng	489 KB
1	1

	Domain	Requested by
1	eduplus.sch.ng
1	1

This site contains links to these domains. Also see Links.

Domain
www.mtb.com
upgrade.mtb.com
asset.mtb.com
mtb.com

Subject Issuer	Validity	Valid
*.eduplus.sch.ng R3	`2022-11-27` - `2023-02-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://eduplus.sch.ng/decline/payment/mail.html
Frame ID: 95897F33F8553DEF35B7FFD226E2059A
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Welcome to Online Banking | M&T Bank

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

618 kB
Transfer

621 kB
Size

0
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://www.mtb.com/home-page

Search URL Search Domain Scan URL

URL: https://upgrade.mtb.com/olb-upgrade
Title: Get Started Guide

Search URL Search Domain Scan URL

URL: https://www.mtb.com/olbsecurity
Title: Security Assistance

Search URL Search Domain Scan URL

URL: https://asset.mtb.com/Documents/html/DSA.htm
Title: Digital Service Agreement

Search URL Search Domain Scan URL

URL: https://asset.mtb.com/Documents/html/ESign.htm
Title: ESign Agreement

Search URL Search Domain Scan URL

URL: https://mtb.com/olb-accessibility
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://www.mtb.com/olb-personalsite
Title: mtb.com

Search URL Search Domain Scan URL

URL: https://www.mtb.com/help-center/policies/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.mtb.com/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.mtb.com/equalhousinglender

Search URL Search Domain Scan URL

URL: https://www.mtb.com/olb-entrust

Search URL Search Domain Scan URL

URL: https://www.mtb.com/fdic
Title: Member FDIC

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request mail.html Show response eduplus.sch.ng/decline/payment/	488 KB 489 KB	343ms 107ms	Document text/html	192.3.137.194 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://eduplus.sch.ng/decline/payment/mail.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 192.3.137.194 Denver, United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS wgh13.wghservers.com Software Apache / Resource Hash `1f26ff3d82558674eebdcfbe283b66a6f5d645db5c90073c4bc0c2cd93da0a2e` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 500114 Content-Type text/html Date Wed, 25 Jan 2023 08:59:24 GMT Keep-Alive timeout=5, max=100 Last-Modified Fri, 24 Sep 2021 20:11:16 GMT Server Apache
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5f5b0d9f678fe446631a33a4cbbe891a01b0ed972143702e67ae6617367096ac` Request headers accept-language fr-FR,fr;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	66 KB 66 KB		Font application/x-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4029a5a081992259f4e529190b49dbba893931da4e843dd203449f1b9a4509d2` Request headers Referer Origin https://eduplus.sch.ng accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type application/x-woff
GET DATA	200 OK	truncated /	63 KB 63 KB		Font application/x-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b391b55f950528937beee7687717a4aef81196817834f1c93b099713ff738fbc` Request headers Referer Origin https://eduplus.sch.ng accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type application/x-woff
GET DATA	200 OK	truncated /	230 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d58eb2802f72d0c6b1d944a1335e8fb914af44b51fe16097aad994c15b8cfbad` Request headers accept-language fr-FR,fr;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b2ef3bd17aa6bc2daa7b1209f7848b30c64f3068e43162b09a216639ab430ce5` Request headers accept-language fr-FR,fr;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: M&T Bank (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| savepage_ShadowLoader

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

eduplus.sch.ng
192.3.137.194
1f26ff3d82558674eebdcfbe283b66a6f5d645db5c90073c4bc0c2cd93da0a2e
4029a5a081992259f4e529190b49dbba893931da4e843dd203449f1b9a4509d2
5f5b0d9f678fe446631a33a4cbbe891a01b0ed972143702e67ae6617367096ac
b2ef3bd17aa6bc2daa7b1209f7848b30c64f3068e43162b09a216639ab430ce5
b391b55f950528937beee7687717a4aef81196817834f1c93b099713ff738fbc
d58eb2802f72d0c6b1d944a1335e8fb914af44b51fe16097aad994c15b8cfbad

eduplus.sch.ng Open in urlscan Pro 192.3.137.194 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

1 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

618 kBTransfer

621 kBSize

0 Cookies

12 Outgoing links

Redirected requests

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

eduplus.sch.ng Open in urlscan Pro
192.3.137.194 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

618 kB
Transfer

621 kB
Size

0
Cookies

1 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!