cesseguranca.com.br Open in urlscan Pro
15.235.39.189  Malicious Activity! Public Scan

URL: http://cesseguranca.com.br/mantbank/
Submission: On October 26 via api from JP — Scanned from CA

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 24 HTTP transactions. The main IP is 15.235.39.189, located in Canada and belongs to OVH, FR. The main domain is cesseguranca.com.br.
This is the only time cesseguranca.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: M&T Bank (Banking)

Domain & IP information

Domain Requested by
17 cesseguranca.com.br cesseguranca.com.br
2 1.c81358859121583b7adf2ace89cb39f44.com cesseguranca.com.br
1.c81358859121583b7adf2ace89cb39f44.com
2 1.b406929acabac9b095f124c81bdfcf57f.com cesseguranca.com.br
1.b406929acabac9b095f124c81bdfcf57f.com
2 1.a79ab95c1589a13f8a4cab612bc71f9f7.com cesseguranca.com.br
1.a79ab95c1589a13f8a4cab612bc71f9f7.com
24 4

This site contains links to these domains. Also see Links.

Domain
wearesolidarite.com
Subject Issuer Validity Valid
*.a79ab95c1589a13f8a4cab612bc71f9f7.com
Sectigo RSA Domain Validation Secure Server CA
2022-04-04 -
2023-04-04
a year crt.sh
*.b406929acabac9b095f124c81bdfcf57f.com
Sectigo RSA Domain Validation Secure Server CA
2022-04-06 -
2023-04-07
a year crt.sh
*.c81358859121583b7adf2ace89cb39f44.com
Sectigo RSA Domain Validation Secure Server CA
2022-04-06 -
2023-04-07
a year crt.sh

This page contains 4 frames:

Primary Page: http://cesseguranca.com.br/mantbank/
Frame ID: BCDB7FAD3823F85FEE26CBA1398DD6B1
Requests: 22 HTTP requests in this frame

Frame: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Frame ID: F807AB7B9BD33370EAE81D54DE8C3C8C
Requests: 2 HTTP requests in this frame

Frame: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Frame ID: 9FEAC515978F2D327E3060A8A2A08AD8
Requests: 2 HTTP requests in this frame

Frame: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Frame ID: 3080EE8A4D63F9B5F1217EDB624D270A
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

Log in to M&T Online Banking or Commercial Treasury CenterNavigation Menu

Page Statistics

24
Requests

25 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

1723 kB
Transfer

1885 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

24 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
cesseguranca.com.br/mantbank/
80 KB
81 KB
Document
General
Full URL
http://cesseguranca.com.br/mantbank/
Protocol
HTTP/1.1
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
56a6f99d8872d78782b4ca6da983ed70ea0a41973e604b21a1544c54a23fc427

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
82368
Content-Type
text/html
Date
Wed, 26 Oct 2022 04:09:59 GMT
Keep-Alive
timeout=5, max=100
Last-Modified
Wed, 31 Aug 2022 22:13:00 GMT
Server
Apache
clientlib-base.css
cesseguranca.com.br/mantbank/index_files/
426 KB
427 KB
Stylesheet
General
Full URL
http://cesseguranca.com.br/mantbank/index_files/clientlib-base.css
Requested by
Host: cesseguranca.com.br
URL: http://cesseguranca.com.br/mantbank/
Protocol
HTTP/1.1
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
0241159456863a6baa0790dfb58ab3c6dd892f080ee2a52259fb101f4c166412

Request headers

accept-language
en-CA,en;q=0.9
Referer
http://cesseguranca.com.br/mantbank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Wed, 26 Oct 2022 04:09:59 GMT
Last-Modified
Wed, 31 Aug 2022 10:43:12 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
436674
mtb_app_wbk.js.download
cesseguranca.com.br/mantbank/index_files/
242 KB
243 KB
Script
General
Full URL
http://cesseguranca.com.br/mantbank/index_files/mtb_app_wbk.js.download
Requested by
Host: cesseguranca.com.br
URL: http://cesseguranca.com.br/mantbank/
Protocol
HTTP/1.1
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
b9b7a642f229db0bbc0a820e1eee063041d03ab631f868e8106c1aa1c4647b75

Request headers

accept-language
en-CA,en;q=0.9
Referer
http://cesseguranca.com.br/mantbank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Wed, 26 Oct 2022 04:09:59 GMT
Last-Modified
Wed, 31 Aug 2022 10:43:12 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
248194
cdsession.js.download
cesseguranca.com.br/mantbank/index_files/
605 KB
605 KB
Script
General
Full URL
http://cesseguranca.com.br/mantbank/index_files/cdsession.js.download
Requested by
Host: cesseguranca.com.br
URL: http://cesseguranca.com.br/mantbank/
Protocol
HTTP/1.1
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
302462d4283c45e7405dcaf5036c9f1e34982c47baaa0a39c2b45e6cb9a203f4

Request headers

accept-language
en-CA,en;q=0.9
Referer
http://cesseguranca.com.br/mantbank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Wed, 26 Oct 2022 04:09:59 GMT
Last-Modified
Wed, 31 Aug 2022 10:43:12 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
619717
vendor.js.download
cesseguranca.com.br/mantbank/index_files/
236 KB
237 KB
Script
General
Full URL
http://cesseguranca.com.br/mantbank/index_files/vendor.js.download
Requested by
Host: cesseguranca.com.br
URL: http://cesseguranca.com.br/mantbank/
Protocol
HTTP/1.1
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
c5bac5c06dfc6a8b1547af4e6dfa0d784f70db7c92cfe1e97c45e962f0283d0c

Request headers

accept-language
en-CA,en;q=0.9
Referer
http://cesseguranca.com.br/mantbank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Wed, 26 Oct 2022 04:09:59 GMT
Last-Modified
Wed, 31 Aug 2022 10:43:12 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
242127
white%20logo.png
cesseguranca.com.br/mantbank/index_files/
5 KB
5 KB
Image
General
Full URL
http://cesseguranca.com.br/mantbank/index_files/white%20logo.png
Requested by
Host: cesseguranca.com.br
URL: http://cesseguranca.com.br/mantbank/
Protocol
HTTP/1.1
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
68d12e8086357835fc398c26ffc15a2ad73d6c1ceb930e545982149af754e652

Request headers

accept-language
en-CA,en;q=0.9
Referer
http://cesseguranca.com.br/mantbank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Wed, 26 Oct 2022 04:10:00 GMT
Last-Modified
Wed, 31 Aug 2022 10:43:12 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
4936
equal-housing-lender-logo.png
cesseguranca.com.br/mantbank/index_files/
1 KB
2 KB
Image
General
Full URL
http://cesseguranca.com.br/mantbank/index_files/equal-housing-lender-logo.png
Requested by
Host: cesseguranca.com.br
URL: http://cesseguranca.com.br/mantbank/
Protocol
HTTP/1.1
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
46c43686825a8cb8bf832253977abfb4871e5d9014cb6912e8519c736a6253d3

Request headers

accept-language
en-CA,en;q=0.9
Referer
http://cesseguranca.com.br/mantbank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Wed, 26 Oct 2022 04:10:00 GMT
Last-Modified
Wed, 31 Aug 2022 10:43:14 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
1509
fszullhwyai6bvj-desktop-720x816-update.jpeg
cesseguranca.com.br/mantbank/index_files/
111 KB
111 KB
Image
General
Full URL
http://cesseguranca.com.br/mantbank/index_files/fszullhwyai6bvj-desktop-720x816-update.jpeg
Requested by
Host: cesseguranca.com.br
URL: http://cesseguranca.com.br/mantbank/
Protocol
HTTP/1.1
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
e3600cc522d109bf4d7aeb56960790240e80d9f22f6ae99e9a77d020bdf8f3cd

Request headers

accept-language
en-CA,en;q=0.9
Referer
http://cesseguranca.com.br/mantbank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Wed, 26 Oct 2022 04:10:00 GMT
Last-Modified
Wed, 31 Aug 2022 10:43:14 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
113904
fszullhwyai6bvj.jpeg
cesseguranca.com.br/mantbank/index_files/
315 B
315 B
Image
General
Full URL
http://cesseguranca.com.br/mantbank/index_files/fszullhwyai6bvj.jpeg
Requested by
Host: cesseguranca.com.br
URL: http://cesseguranca.com.br/mantbank/
Protocol
HTTP/1.1
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

accept-language
en-CA,en;q=0.9
Referer
http://cesseguranca.com.br/mantbank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Wed, 26 Oct 2022 04:10:00 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=97
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
mandtbaltoweb-book.woff
cesseguranca.com.br/mantbank/index_files/clientlib-site/resources/fonts/MTB_Balto/Webfonts/
0
0
Font
General
Full URL
http://cesseguranca.com.br/mantbank/index_files/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-book.woff
Requested by
Host: cesseguranca.com.br
URL: http://cesseguranca.com.br/mantbank/index_files/clientlib-base.css
Protocol
HTTP/1.1
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash

Request headers

Referer
http://cesseguranca.com.br/mantbank/index_files/clientlib-base.css
Origin
http://cesseguranca.com.br
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Wed, 26 Oct 2022 04:10:00 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=98
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
3026db81-b86b-482a-80f3-e6140164f995
http://cesseguranca.com.br/
165 KB
0
Other
General
Full URL
blob:http://cesseguranca.com.br/3026db81-b86b-482a-80f3-e6140164f995
Requested by
Host: cesseguranca.com.br
URL: http://cesseguranca.com.br/mantbank/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
25e521f17135f161c1f02f0555af227292ab009967c461380e3135c414f288e6

Request headers

accept-language
en-CA,en;q=0.9
Referer
http://cesseguranca.com.br/mantbank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Length
169098
mandtbaltoweb-book.woff
cesseguranca.com.br/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/
0
0
Font
General
Full URL
http://cesseguranca.com.br/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-book.woff
Requested by
Host: cesseguranca.com.br
URL: http://cesseguranca.com.br/mantbank/index_files/clientlib-base.css
Protocol
HTTP/1.1
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash

Request headers

Referer
http://cesseguranca.com.br/mantbank/index_files/clientlib-base.css
Origin
http://cesseguranca.com.br
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Wed, 26 Oct 2022 04:10:00 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=97
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
chevron_down.8adc6731.svg
cesseguranca.com.br/mantbank/css/
315 B
315 B
Image
General
Full URL
http://cesseguranca.com.br/mantbank/css/chevron_down.8adc6731.svg
Requested by
Host: cesseguranca.com.br
URL: http://cesseguranca.com.br/mantbank/
Protocol
HTTP/1.1
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

accept-language
en-CA,en;q=0.9
Referer
http://cesseguranca.com.br/mantbank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Wed, 26 Oct 2022 04:10:00 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=96
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
mandtbaltoweb-light.woff
cesseguranca.com.br/mantbank/index_files/clientlib-site/resources/fonts/MTB_Balto/Webfonts/
0
0
Font
General
Full URL
http://cesseguranca.com.br/mantbank/index_files/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-light.woff
Requested by
Host: cesseguranca.com.br
URL: http://cesseguranca.com.br/mantbank/index_files/clientlib-base.css
Protocol
HTTP/1.1
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash

Request headers

Referer
http://cesseguranca.com.br/mantbank/index_files/clientlib-base.css
Origin
http://cesseguranca.com.br
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Wed, 26 Oct 2022 04:10:00 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=96
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
mandtbaltoweb-medium.woff
cesseguranca.com.br/mantbank/index_files/clientlib-site/resources/fonts/MTB_Balto/Webfonts/
0
0
Font
General
Full URL
http://cesseguranca.com.br/mantbank/index_files/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-medium.woff
Requested by
Host: cesseguranca.com.br
URL: http://cesseguranca.com.br/mantbank/index_files/clientlib-base.css
Protocol
HTTP/1.1
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash

Request headers

Referer
http://cesseguranca.com.br/mantbank/index_files/clientlib-base.css
Origin
http://cesseguranca.com.br
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Wed, 26 Oct 2022 04:10:00 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
fszullhwyai6bvj-desktop-720x816-update.jpeg
cesseguranca.com.br/mantbank/css/
315 B
315 B
Image
General
Full URL
http://cesseguranca.com.br/mantbank/css/fszullhwyai6bvj-desktop-720x816-update.jpeg
Requested by
Host: cesseguranca.com.br
URL: http://cesseguranca.com.br/mantbank/
Protocol
HTTP/1.1
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

accept-language
en-CA,en;q=0.9
Referer
http://cesseguranca.com.br/mantbank/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Wed, 26 Oct 2022 04:10:00 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=95
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
mandtbaltoweb-light.woff
cesseguranca.com.br/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/
0
0
Font
General
Full URL
http://cesseguranca.com.br/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-light.woff
Requested by
Host: cesseguranca.com.br
URL: http://cesseguranca.com.br/mantbank/index_files/clientlib-base.css
Protocol
HTTP/1.1
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash

Request headers

Referer
http://cesseguranca.com.br/mantbank/index_files/clientlib-base.css
Origin
http://cesseguranca.com.br
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Wed, 26 Oct 2022 04:10:00 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=94
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
mandtbaltoweb-medium.woff
cesseguranca.com.br/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/
0
0
Font
General
Full URL
http://cesseguranca.com.br/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-medium.woff
Requested by
Host: cesseguranca.com.br
URL: http://cesseguranca.com.br/mantbank/index_files/clientlib-base.css
Protocol
HTTP/1.1
Server
15.235.39.189 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip189.ip-15-235-39.fmhospeda.com.br
Software
Apache /
Resource Hash

Request headers

Referer
http://cesseguranca.com.br/mantbank/index_files/clientlib-base.css
Origin
http://cesseguranca.com.br
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Wed, 26 Oct 2022 04:10:00 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=98
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
truncated
/
89 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
83b7bc3a6730a7762f5cd69f0a5698beee63eb07a0a66804dc3ed7c21cb51f3a

Request headers

accept-language
en-CA,en;q=0.9
Referer
http://cesseguranca.com.br/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
89 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
33d14acacf40372d80e76719ef2003a134c13fdbfd84f5a730b29f16e5d3eb9d

Request headers

accept-language
en-CA,en;q=0.9
Referer
http://cesseguranca.com.br/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
89 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7433ef23bb48cab684848dd1d65ce9e61a999a059256d867edeb72cebb2c24f0

Request headers

accept-language
en-CA,en;q=0.9
Referer
http://cesseguranca.com.br/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
89 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bf1a1d972a6cf7f401aa7ca54218da815d740a930c0f2294b7f3362c99e32dcf

Request headers

accept-language
en-CA,en;q=0.9
Referer
http://cesseguranca.com.br/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/png
crossdomain.html
1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/ Frame F807
221 B
557 B
Document
General
Full URL
https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Requested by
Host: cesseguranca.com.br
URL: http://cesseguranca.com.br/mantbank/index_files/cdsession.js.download
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20ed:e600:a:6cdf:4440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer
http://cesseguranca.com.br/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
78355
content-length
221
content-type
text/html
date
Tue, 25 Oct 2022 06:24:06 GMT
etag
"21e34cf6a03f570df49e212018a567d0"
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
via
1.1 29cb8c298da4d2ced72495e99456ecc8.cloudfront.net (CloudFront)
x-amz-cf-id
4pImC8BGZnOnqpp17WXMuhdOaJVvCTnOqiKN1ZF8rNhw8p7nUoQkEQ==
x-amz-cf-pop
PHL50-C1
x-amz-version-id
null
x-cache
Hit from cloudfront
crossdomain.html
1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/ Frame 9FEA
221 B
556 B
Document
General
Full URL
https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Requested by
Host: cesseguranca.com.br
URL: http://cesseguranca.com.br/mantbank/index_files/cdsession.js.download
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20ed:800:1e:54f1:26c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer
http://cesseguranca.com.br/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
54418
content-length
221
content-type
text/html
date
Tue, 25 Oct 2022 13:03:03 GMT
etag
"21e34cf6a03f570df49e212018a567d0"
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
via
1.1 4ec5361277f6487ae5a8f880297d598c.cloudfront.net (CloudFront)
x-amz-cf-id
rY442lZ-0QPYkXJLBFtcQMMBLW4wHGieeu7CU2e8o3alkimg3FGLRw==
x-amz-cf-pop
PHL50-C1
x-amz-version-id
null
x-cache
Hit from cloudfront
crossdomain.html
1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/ Frame 3080
221 B
556 B
Document
General
Full URL
https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Requested by
Host: cesseguranca.com.br
URL: http://cesseguranca.com.br/mantbank/index_files/cdsession.js.download
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20ed:0:13:ab57:d440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer
http://cesseguranca.com.br/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
61984
content-length
221
content-type
text/html
date
Tue, 25 Oct 2022 10:56:57 GMT
etag
"21e34cf6a03f570df49e212018a567d0"
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
via
1.1 4ec5361277f6487ae5a8f880297d598c.cloudfront.net (CloudFront)
x-amz-cf-id
QgyY7IJ6-nFo2yiOXAk7Y03u5ZCg2dKjVux8ZWI-hkrf3BhbQEQGcA==
x-amz-cf-pop
PHL50-C1
x-amz-version-id
null
x-cache
Hit from cloudfront
crossdomain2.12.0.5273.b96c35cc.min.js
1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/ Frame 9FEA
3 KB
3 KB
Script
General
Full URL
https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by
Host: 1.b406929acabac9b095f124c81bdfcf57f.com
URL: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20ed:800:1e:54f1:26c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-amz-version-id
null
date
Tue, 25 Oct 2022 04:47:48 GMT
via
1.1 4ec5361277f6487ae5a8f880297d598c.cloudfront.net (CloudFront)
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
x-amz-cf-pop
PHL50-C1
age
84133
etag
"9ee48a4da9c402e8a23ad085fb71f28f"
x-cache
Hit from cloudfront
content-type
application/javascript
accept-ranges
bytes
content-length
3227
x-amz-cf-id
D9UhYJm8JHEUp5cNYpWArUbYJC7BFt_VKUiXiLlwA2K5I6XXWFgq5A==
crossdomain2.12.0.5273.b96c35cc.min.js
1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/ Frame F807
3 KB
3 KB
Script
General
Full URL
https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by
Host: 1.a79ab95c1589a13f8a4cab612bc71f9f7.com
URL: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20ed:e600:a:6cdf:4440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-amz-version-id
null
date
Tue, 25 Oct 2022 13:11:34 GMT
via
1.1 29cb8c298da4d2ced72495e99456ecc8.cloudfront.net (CloudFront)
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
x-amz-cf-pop
PHL50-C1
age
53907
etag
"9ee48a4da9c402e8a23ad085fb71f28f"
x-cache
Hit from cloudfront
content-type
application/javascript
accept-ranges
bytes
content-length
3227
x-amz-cf-id
ymbCAgeyLOAkpUj7B22NJqqObfLlJ55Wpmrw_MQ1OjNZirT05ewnqw==
crossdomain2.12.0.5273.b96c35cc.min.js
1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/ Frame 3080
3 KB
3 KB
Script
General
Full URL
https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by
Host: 1.c81358859121583b7adf2ace89cb39f44.com
URL: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20ed:0:13:ab57:d440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 06:22:54 GMT
x-amz-version-id
null
via
1.1 4ec5361277f6487ae5a8f880297d598c.cloudfront.net (CloudFront)
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
x-amz-cf-pop
PHL50-C1
age
78426
etag
"9ee48a4da9c402e8a23ad085fb71f28f"
x-cache
Hit from cloudfront
content-type
application/javascript
accept-ranges
bytes
content-length
3227
x-amz-cf-id
i5lRVX1l8D25Pyl57LRxcVsE8lh4MWjVj_WlNdpeEaIeZxQrSKSVsQ==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: M&T Bank (Banking)

73 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| UIEvent object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation object| cdwpb object| cdApi object| Utils object| customEventsObject object| cookiesUtils object| modalObject object| tealiumUtils function| Hashtable function| startsWith function| DomDataCollection function| IE_FingerPrint function| Mozilla_FingerPrint function| Opera_FingerPrint function| Timer function| getRandomPort object| ProxyCollector function| BlackberryLocationCollector function| detectFields string| SEP string| PAIR string| DEV function| FingerPrint function| urlEncode function| encode_deviceprint function| decode_deviceprint function| post_deviceprint function| post_fingerprints function| add_deviceprint function| form_add_data function| form_add_deviceprint string| HTML5 string| BLACKBERRY string| UNDEFINED string| GEO_LOCATION_DEFAULT_STRUCT object| geoLocator boolean| geoLocatorStatus function| detectDeviceCollectionAPIMode function| init function| startCollection function| stopCollection function| getGeolocationStruct function| HTML5LocationCollector object| UIEventCollector function| InteractionElement function| UIElementList function| activeXDetect function| stripIllegalChars function| stripFullPath object| BrowserDetect function| convertTimestampToGMT function| getTimestampInMillis function| debug function| $ function| jQuery function| Cookies function| forceIE89Synchronicity object| lazySizes function| webkitAudioContext function| populateUserId function| cdSession string| style string| d string| t string| m object| s

4 Cookies

Domain/Path Name / Value
cesseguranca.com.br/mantbank Name: cdSessionId
Value: 5ba62c96-8470-4f06-b9f4-a09799f123d5
.cesseguranca.com.br/ Name: cdContextId
Value: 1
.cesseguranca.com.br/ Name: bmuid
Value: 1666757400423-3F93385F-B096-4EA2-A92A-DC53FE316BD1
.cesseguranca.com.br/ Name: cdSNum
Value: 1666757400620-sjn0000140-350da09a-614c-4f4d-8db9-91c84a2360d1

15 Console Messages

Source Level URL
Text
network error URL: http://cesseguranca.com.br/mantbank/index_files/fszullhwyai6bvj.jpeg
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: http://cesseguranca.com.br/mantbank/index_files/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-book.woff
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: http://cesseguranca.com.br/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-book.woff
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: http://cesseguranca.com.br/mantbank/css/chevron_down.8adc6731.svg
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: http://cesseguranca.com.br/mantbank/index_files/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-medium.woff
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: http://cesseguranca.com.br/mantbank/index_files/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-light.woff
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: http://cesseguranca.com.br/mantbank/css/fszullhwyai6bvj-desktop-720x816-update.jpeg
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: http://cesseguranca.com.br/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-light.woff
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: http://cesseguranca.com.br/axp-common/clientlibs/clientlib-site/resources/fonts/MTB_Balto/Webfonts/mandtbaltoweb-medium.woff
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
rendering warning URL: http://cesseguranca.com.br/mantbank/(Line 124)
Message:
Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
rendering warning URL: http://cesseguranca.com.br/mantbank/(Line 124)
Message:
Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
rendering warning URL: http://cesseguranca.com.br/mantbank/(Line 124)
Message:
Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
rendering warning URL: http://cesseguranca.com.br/mantbank/(Line 124)
Message:
Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
rendering warning URL: http://cesseguranca.com.br/mantbank/(Line 124)
Message:
Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
rendering warning URL: http://cesseguranca.com.br/mantbank/(Line 124)
Message:
Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently