urlscan.io logo urlscan.io
SecurityTrails logo

verifysecurex.dedyn.io Open in urlscan Pro
194.49.94.116  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://verifysecurex.dedyn.io/donxx/
Submission: On December 20 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 15 IPs in 3 countries across 12 domains to perform 41 HTTP transactions. The main IP is 194.49.94.116, located in Frankfurt am Main, Germany and belongs to AS_DELIS, US. The main domain is verifysecurex.dedyn.io.
This is the only time verifysecurex.dedyn.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: M&T Bank (Banking)

Domain & IP information

3    194.49.94.116 (Frankfurt am Main, Germany)

ASN211252 (AS_DELIS, US)
verifysecurex.dedyn.io
6    24.75.29.69 (United States)

ASN3356 (LEVEL3, US)
onlinebanking.mtb.com
8    192.216.61.78 (East Aurora, United States)

ASN12134 (MTB, US)
resources.mtb.com
2    2.23.192.238 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-23-192-238.deploy.static.akamaitechnologies.com
tags.tiqcdn.com
1    2606:4700:10::ac43:149e (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.quantummetric.com
1    2606:4700:10::6816:34fc (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.quantummetric.com
2    13.36.218.177 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-36-218-177.eu-west-3.compute.amazonaws.com
mtb.d1.sc.omtrdc.net
1    2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
2    2600:9000:2490:dc00:a:6cdf:4440:93a1 (United States)

ASN16509 (AMAZON-02, US)
1.a79ab95c1589a13f8a4cab612bc71f9f7.com
2    2600:9000:223f:4200:1e:54f1:26c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
1.b406929acabac9b095f124c81bdfcf57f.com
2    2600:9000:2250:f600:13:ab57:d440:93a1 (United States)

ASN16509 (AMAZON-02, US)
1.c81358859121583b7adf2ace89cb39f44.com
1    2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
5    34.67.142.127 (Council Bluffs, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 127.142.67.34.bc.googleusercontent.com
mtb-app.quantummetric.com
Apex Domain
Subdomains		 Transfer
14 mtb.com
onlinebanking.mtb.com — Cisco Umbrella Rank: 110906 Failed
resources.mtb.com — Cisco Umbrella Rank: 130781
1 MB
7 quantummetric.com
cdn.quantummetric.com — Cisco Umbrella Rank: 2026
mtb-app.quantummetric.com — Cisco Umbrella Rank: 72704
81 KB
3 dedyn.io
verifysecurex.dedyn.io
8 KB
2 c81358859121583b7adf2ace89cb39f44.com
1.c81358859121583b7adf2ace89cb39f44.com — Cisco Umbrella Rank: 23095
4 KB
2 b406929acabac9b095f124c81bdfcf57f.com
1.b406929acabac9b095f124c81bdfcf57f.com — Cisco Umbrella Rank: 23062
4 KB
2 a79ab95c1589a13f8a4cab612bc71f9f7.com
1.a79ab95c1589a13f8a4cab612bc71f9f7.com — Cisco Umbrella Rank: 23129
4 KB
2 omtrdc.net
mtb.d1.sc.omtrdc.net — Cisco Umbrella Rank: 74347
2 KB
2 tiqcdn.com
tags.tiqcdn.com — Cisco Umbrella Rank: 931
36 KB
1 google.de
www.google.de — Cisco Umbrella Rank: 6041
548 B
1 google.com
www.google.com — Cisco Umbrella Rank: 2
548 B
1 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 34
1 KB
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 51
66 KB
41 12
Domain Requested by
8 resources.mtb.com verifysecurex.dedyn.io
resources.mtb.com
6 onlinebanking.mtb.com verifysecurex.dedyn.io
5 mtb-app.quantummetric.com cdn.quantummetric.com
3 verifysecurex.dedyn.io onlinebanking.mtb.com
2 1.c81358859121583b7adf2ace89cb39f44.com onlinebanking.mtb.com
1.c81358859121583b7adf2ace89cb39f44.com
2 1.b406929acabac9b095f124c81bdfcf57f.com onlinebanking.mtb.com
1.b406929acabac9b095f124c81bdfcf57f.com
2 1.a79ab95c1589a13f8a4cab612bc71f9f7.com onlinebanking.mtb.com
1.a79ab95c1589a13f8a4cab612bc71f9f7.com
2 mtb.d1.sc.omtrdc.net 1 redirects verifysecurex.dedyn.io
2 cdn.quantummetric.com 1 redirects verifysecurex.dedyn.io
2 tags.tiqcdn.com onlinebanking.mtb.com
tags.tiqcdn.com
1 www.google.de verifysecurex.dedyn.io
1 www.google.com verifysecurex.dedyn.io
1 googleads.g.doubleclick.net www.googletagmanager.com
1 www.googletagmanager.com tags.tiqcdn.com
41 14

This site contains links to these domains. Also see Links.

Domain
www.mtb.com
onlinebanking.mtb.com
upgrade.mtb.com
www3.mtb.com
asset.mtb.com
mtb.com
Subject Issuer Validity Valid
onlinebanking.mtb.com
Entrust Certification Authority - L1M		 2022-07-25 -
2023-08-24		 a year crt.sh
resources.mtb.com
Entrust Certification Authority - L1M		 2022-05-11 -
2023-05-27		 a year crt.sh
*.tiqcdn.com
DigiCert SHA2 Secure Server CA		 2022-02-27 -
2023-02-28		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-11-28 -
2023-02-20		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-11-28 -
2023-02-20		 3 months crt.sh
*.a79ab95c1589a13f8a4cab612bc71f9f7.com
Sectigo RSA Domain Validation Secure Server CA		 2022-04-04 -
2023-04-04		 a year crt.sh
*.b406929acabac9b095f124c81bdfcf57f.com
Sectigo RSA Domain Validation Secure Server CA		 2022-04-06 -
2023-04-07		 a year crt.sh
*.c81358859121583b7adf2ace89cb39f44.com
Sectigo RSA Domain Validation Secure Server CA		 2022-04-06 -
2023-04-07		 a year crt.sh
www.google.com
GTS CA 1C3		 2022-11-28 -
2023-02-20		 3 months crt.sh
www.google.de
GTS CA 1C3		 2022-11-28 -
2023-02-20		 3 months crt.sh
*.quantummetric.com
Sectigo RSA Domain Validation Secure Server CA		 2022-01-18 -
2023-02-13		 a year crt.sh

This page contains 5 frames:

Primary Page: http://verifysecurex.dedyn.io/donxx/
Frame ID: 16F6C1ECDE9883A1F42F1BB7D3F64BEB
Requests: 31 HTTP requests in this frame

Frame: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Frame ID: 1281529D87AC5714B4431C1CDF9B6950
Requests: 2 HTTP requests in this frame

Frame: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Frame ID: 4B1DA60CC07339E9DBFB8EB60BE4426B
Requests: 2 HTTP requests in this frame

Frame: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Frame ID: 8CC7DF8608C2B7B47FE80D4755439C6C
Requests: 2 HTTP requests in this frame

Frame: https://mtb-app.quantummetric.com/?T=B&u=http%3A%2F%2Fverifysecurex.dedyn.io%2Fdonxx%2F&t=1671499981575&v=1671499982082&z=1&S=0&N=0&P=0
Frame ID: 42CD2A36BB76D67E4889434B97289E53
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Welcome to Online Banking | M&T Bank

Detected technologies

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Page Statistics

41
Requests

73 %
HTTPS

60 %
IPv6

12
Domains

14
Subdomains

15
IPs

3
Countries

1411 kB
Transfer

2668 kB
Size

15
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 18
  • http://cdn.quantummetric.com/qscripts/quantum-mtb.js HTTP 301
  • https://cdn.quantummetric.com/qscripts/quantum-mtb.js
Request Chain 20
  • http://mtb.d1.sc.omtrdc.net/b/ss/mtb/1/JS-2.9.0/s86072793994866?AQB=1&ndh=1&pf=1&t=20%2F11%2F2022%201%3A33%3A0%202%200&ce=UTF-8&pageName=OLB%3ALogin%3AIndex&g=http%3A%2F%2Fverifysecurex.dedyn.io%2Fdonxx%2F&cc=USD&c17=Monday%3A8%3A30PM&v19=D%3Dc17&c20=D%3Dg&c21=1&v21=D%3Dg&c22=New&v22=1&c23=Cookies%20Not%20Supported&v23=New&v24=Cookies%20Not%20Supported&v27=D%3DpageName&c41=OLB&v41=OLB&v136=1671499980306&v151=Tealium&s=1600x1200&c=24&j=1.6&v=N&k=N&bw=1600&bh=1200&AQE=1 HTTP 302
  • http://mtb.d1.sc.omtrdc.net/b/ss/mtb/1/JS-2.9.0/s86072793994866?AQB=1&pccr=true&ndh=1&pf=1&t=20%2F11%2F2022%201%3A33%3A0%202%200&ce=UTF-8&pageName=OLB%3ALogin%3AIndex&g=http%3A%2F%2Fverifysecurex.dedyn.io%2Fdonxx%2F&cc=USD&c17=Monday%3A8%3A30PM&v19=D%3Dc17&c20=D%3Dg&c21=1&v21=D%3Dg&c22=New&v22=1&c23=Cookies%20Not%20Supported&v23=New&v24=Cookies%20Not%20Supported&v27=D%3DpageName&c41=OLB&v41=OLB&v136=1671499980306&v151=Tealium&s=1600x1200&c=24&j=1.6&v=N&k=N&bw=1600&bh=1200&AQE=1

41 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
verifysecurex.dedyn.io/donxx/ 		17 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://verifysecurex.dedyn.io/donxx/
Protocol
HTTP/1.1
Server
194.49.94.116 Frankfurt am Main, Germany, ASN211252 (AS_DELIS, US),
Reverse DNS
Software
nginx /
Resource Hash
df06d64b1b7dfce7398d5b8db3361da96b36b8e980fcaa1f2fdf8a4f6f2b2347

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
6205
Content-Type
text/html
Date
Tue, 20 Dec 2022 01:32:57 GMT
ETag
"455d-5f0349cd8e59c-gzip"
Last-Modified
Mon, 19 Dec 2022 21:00:43 GMT
Server
nginx
Vary
Accept-Encoding
0856addebbab200038d7ae08cdade4c837e7f1d49e5435ee587b4dcec3e62d370319177decab29bc
onlinebanking.mtb.com/TSPD/ 		0
0
0856addebbab200038d7ae08cdade4c837e7f1d49e5435ee587b4dcec3e62d370319177decab29bc
onlinebanking.mtb.com/TSPD/ 		0
0
mtb_app_wbk.js
onlinebanking.mtb.com/Assets/js/ 		286 KB
167 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onlinebanking.mtb.com/Assets/js/mtb_app_wbk.js
Requested by
Host: verifysecurex.dedyn.io
URL: http://verifysecurex.dedyn.io/donxx/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
24.75.29.69 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software
/
Resource Hash
72090ef4a2e4ceb1c58a57cf49a6ff27601b51aae2479b3bfb8cc12a791a6f54

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Dec 2022 01:32:58 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
Content-Type
application/javascript; charset=UTF-8
X-Ion-Hop
1
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Expires
0
css.mtb
resources.mtb.com/r/simple-layout-responsive/ 		253 KB
35 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://resources.mtb.com/r/simple-layout-responsive/css.mtb?v=12082022125000
Requested by
Host: verifysecurex.dedyn.io
URL: http://verifysecurex.dedyn.io/donxx/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
192.216.61.78 East Aurora, United States, ASN12134 (MTB, US),
Reverse DNS
Software
/
Resource Hash
79feb75fef9778bdc2fe775ed5e1aad4308c2312ecec0825409c161b6e5f2903
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date
Tue, 20 Dec 2022 01:32:57 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Dec 2022 01:32:57 GMT
X-Srv
M-SC-01
ETag
"1671499978:dtagent10253221019152312ShlF"
ntCoent-Length
258715
Vary
User-Agent
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
Content-Type
text/css; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
private
Transfer-Encoding
chunked
Server-Timing
dtSInfo;desc="0", dtRpid;desc="391072824"
Expires
Wed, 20 Dec 2023 01:32:58 GMT
ruxitagentjs_ICA2NVfghjqrux_10253221019152312.js
onlinebanking.mtb.com/ 		252 KB
96 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onlinebanking.mtb.com/ruxitagentjs_ICA2NVfghjqrux_10253221019152312.js
Requested by
Host: verifysecurex.dedyn.io
URL: http://verifysecurex.dedyn.io/donxx/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
24.75.29.69 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software
/
Resource Hash
da505e58bfb9de59f6c56ef0f0ceb296d42d3682ea25f8b75620621d8f4cdcb5
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date
Tue, 20 Dec 2022 01:32:59 GMT
Content-Encoding
gzip
Last-Modified
Wed, 03 Mar 2010 07:01:40 GMT
X-SRV
B-WEB-12
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
P3P
CP='CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT'
Content-Type
text/javascript; charset=utf-8
Cache-Control
public, max-age=31536000, immutable
Content-Length
96756
Expires
Wed, 20 Dec 2023 01:32:59 GMT
tealium_prod.js
onlinebanking.mtb.com/Assets/js/ 		307 B
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onlinebanking.mtb.com/Assets/js/tealium_prod.js
Requested by
Host: verifysecurex.dedyn.io
URL: http://verifysecurex.dedyn.io/donxx/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
24.75.29.69 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software
/
Resource Hash
bcc41de3276fb2e7cf0be64b6a62e5306e18efbf14efa5379c1d89acad6ffc2a
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date
Tue, 20 Dec 2022 01:32:59 GMT
Last-Modified
Fri, 16 Dec 2022 06:29:58 GMT
X-SRV
B-WEB-12
ETag
"07772d11711d91:0"
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
P3P
CP='CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT'
Content-Type
application/x-javascript
Cache-Control
max-age=1800
Server-Timing
dtSInfo;desc="0", dtRpid;desc="1541538918"
Accept-Ranges
bytes
Content-Length
307
mtb-logo.svg
resources.mtb.com/Assets/img/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://resources.mtb.com/Assets/img/mtb-logo.svg
Requested by
Host: verifysecurex.dedyn.io
URL: http://verifysecurex.dedyn.io/donxx/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
192.216.61.78 East Aurora, United States, ASN12134 (MTB, US),
Reverse DNS
Software
/
Resource Hash
5f5b0d9f678fe446631a33a4cbbe891a01b0ed972143702e67ae6617367096ac
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date
Tue, 20 Dec 2022 01:32:59 GMT
Last-Modified
Fri, 16 Dec 2022 06:37:56 GMT
X-Srv
M-SC-01
ETag
"07a5bee1811d91:0"
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Server-Timing
dtSInfo;desc="0", dtRpid;desc="-1562722163"
Accept-Ranges
bytes
Content-Length
2039
mtb-equalhousinglender.svg
resources.mtb.com/Assets/img/ 		230 B
811 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://resources.mtb.com/Assets/img/mtb-equalhousinglender.svg
Requested by
Host: verifysecurex.dedyn.io
URL: http://verifysecurex.dedyn.io/donxx/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
192.216.61.78 East Aurora, United States, ASN12134 (MTB, US),
Reverse DNS
Software
/
Resource Hash
d58eb2802f72d0c6b1d944a1335e8fb914af44b51fe16097aad994c15b8cfbad
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date
Tue, 20 Dec 2022 01:32:59 GMT
Last-Modified
Fri, 16 Dec 2022 06:37:56 GMT
X-Srv
M-SC-01
ETag
"07a5bee1811d91:0"
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Server-Timing
dtSInfo;desc="0", dtRpid;desc="1995097264"
Accept-Ranges
bytes
Content-Length
230
mtb-entrust.svg
resources.mtb.com/Assets/img/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://resources.mtb.com/Assets/img/mtb-entrust.svg
Requested by
Host: verifysecurex.dedyn.io
URL: http://verifysecurex.dedyn.io/donxx/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
192.216.61.78 East Aurora, United States, ASN12134 (MTB, US),
Reverse DNS
Software
/
Resource Hash
b2ef3bd17aa6bc2daa7b1209f7848b30c64f3068e43162b09a216639ab430ce5
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date
Tue, 20 Dec 2022 01:32:59 GMT
Last-Modified
Fri, 16 Dec 2022 06:37:56 GMT
X-Srv
M-SC-01
ETag
"07a5bee1811d91:0"
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Server-Timing
dtSInfo;desc="0", dtRpid;desc="-1550666749"
Accept-Ranges
bytes
Content-Length
1349
js.mtb
resources.mtb.com/r/simple-layout-responsive/ 		315 KB
102 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.mtb.com/r/simple-layout-responsive/js.mtb?v=12082022125000
Requested by
Host: verifysecurex.dedyn.io
URL: http://verifysecurex.dedyn.io/donxx/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
192.216.61.78 East Aurora, United States, ASN12134 (MTB, US),
Reverse DNS
Software
/
Resource Hash
6ef98ef294d03000d904d5f868598dc98667a0d00338cee40b3080a9d725d1cd
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Cteonnt-Length
322405
Date
Tue, 20 Dec 2022 01:32:59 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Dec 2022 01:32:58 GMT
X-Srv
M-SC-01
ETag
"1671499979:dtagent10253221019152312ShlF"
Vary
User-Agent
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
private
Transfer-Encoding
chunked
Server-Timing
dtSInfo;desc="0", dtRpid;desc="-1578319171"
Expires
Wed, 20 Dec 2023 01:32:59 GMT
kessel-client-prod.js
onlinebanking.mtb.com/Assets/js/ 		651 KB
652 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onlinebanking.mtb.com/Assets/js/kessel-client-prod.js
Requested by
Host: verifysecurex.dedyn.io
URL: http://verifysecurex.dedyn.io/donxx/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
24.75.29.69 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software
/
Resource Hash
f78201bc5207eca0e7c28127849178c04dfbac606927804c31f6af106b02e266
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date
Tue, 20 Dec 2022 01:32:59 GMT
Last-Modified
Fri, 16 Dec 2022 06:29:58 GMT
X-SRV
B-WEB-12
ETag
"07772d11711d91:0"
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
P3P
CP='CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT'
Content-Type
application/x-javascript
Cache-Control
max-age=1800
Server-Timing
dtSInfo;desc="0", dtRpid;desc="-500312603"
Accept-Ranges
bytes
Content-Length
666659
kessel-help.js
onlinebanking.mtb.com/Assets/scripts/ 		263 B
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onlinebanking.mtb.com/Assets/scripts/kessel-help.js
Requested by
Host: verifysecurex.dedyn.io
URL: http://verifysecurex.dedyn.io/donxx/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
24.75.29.69 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software
/
Resource Hash
0dc8244726314592a0fc6e67259c596a0d89160f844cf6cad576a78ce3331f87
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date
Tue, 20 Dec 2022 01:32:59 GMT
Last-Modified
Fri, 16 Dec 2022 06:29:58 GMT
X-SRV
B-WEB-12
ETag
"07772d11711d91:0"
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
P3P
CP='CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT'
Content-Type
application/x-javascript
Cache-Control
max-age=1800
Server-Timing
dtSInfo;desc="0", dtRpid;desc="-544802733"
Accept-Ranges
bytes
Content-Length
263
Index.js
onlinebanking.mtb.com/Assets/scripts/Login/ 		7 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onlinebanking.mtb.com/Assets/scripts/Login/Index.js
Requested by
Host: verifysecurex.dedyn.io
URL: http://verifysecurex.dedyn.io/donxx/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
24.75.29.69 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software
/
Resource Hash
913b1bf2f19b8b9943e12461323a4368f5bed8c01108cb1e72a9f128c89c03f2
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date
Tue, 20 Dec 2022 01:32:59 GMT
Last-Modified
Fri, 16 Dec 2022 06:29:58 GMT
X-SRV
B-WEB-12
ETag
"07772d11711d91:0"
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
P3P
CP='CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT'
Content-Type
application/x-javascript
Cache-Control
max-age=1800
Server-Timing
dtSInfo;desc="0", dtRpid;desc="-1649446085"
Accept-Ranges
bytes
Content-Length
6950
utag.js
tags.tiqcdn.com/utag/mtbank/olb-legacy/prod/ 		95 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/mtbank/olb-legacy/prod/utag.js
Requested by
Host: onlinebanking.mtb.com
URL: https://onlinebanking.mtb.com/Assets/js/tealium_prod.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.23.192.238 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-23-192-238.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
76326e2beb8d7a9ebf598e12e0b5d927654bde867b37ae4d890337218895c42f

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Tue, 20 Dec 2022 01:32:59 GMT
content-encoding
gzip
last-modified
Fri, 02 Dec 2022 21:29:42 GMT
server
AkamaiNetStorage
etag
"c8ae75d315408d38b63707d959bcd1e5:1670016582.449682"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=300
accept-ranges
bytes
content-length
33053
expires
Tue, 20 Dec 2022 01:37:59 GMT
mandtbaltoweb-book.woff
resources.mtb.com/assets/fonts/ 		66 KB
67 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://resources.mtb.com/assets/fonts/mandtbaltoweb-book.woff
Requested by
Host: resources.mtb.com
URL: https://resources.mtb.com/r/simple-layout-responsive/css.mtb?v=12082022125000
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
192.216.61.78 East Aurora, United States, ASN12134 (MTB, US),
Reverse DNS
Software
/
Resource Hash
4029a5a081992259f4e529190b49dbba893931da4e843dd203449f1b9a4509d2
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

Referer
https://resources.mtb.com/r/simple-layout-responsive/css.mtb?v=12082022125000
Origin
http://verifysecurex.dedyn.io
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date
Tue, 20 Dec 2022 01:32:59 GMT
Last-Modified
Fri, 16 Dec 2022 06:37:55 GMT
X-Srv
M-SC-01
ETag
"07a5bee1811d91:0:dtagent10253221019152312ShlF"
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
Content-Type
APPLICATION/X-WOFF
Access-Control-Allow-Origin
*
Server-Timing
dtSInfo;desc="0", dtRpid;desc="-653709607"
Accept-Ranges
bytes
Content-Length
67671
mandtpg-iconfont.woff
resources.mtb.com/assets/fonts/ 		5 KB
5 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://resources.mtb.com/assets/fonts/mandtpg-iconfont.woff
Requested by
Host: resources.mtb.com
URL: https://resources.mtb.com/r/simple-layout-responsive/css.mtb?v=12082022125000
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
192.216.61.78 East Aurora, United States, ASN12134 (MTB, US),
Reverse DNS
Software
/
Resource Hash
108d16421ae2ff7fc5157d507dc5b1bf7f62140ba58cf3c723b1f2b7e74c21df
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

Referer
https://resources.mtb.com/r/simple-layout-responsive/css.mtb?v=12082022125000
Origin
http://verifysecurex.dedyn.io
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date
Tue, 20 Dec 2022 01:32:59 GMT
Last-Modified
Fri, 16 Dec 2022 06:37:55 GMT
X-Srv
M-SC-01
ETag
"07a5bee1811d91:0:dtagent10253221019152312ShlF"
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
Content-Type
APPLICATION/X-WOFF
Access-Control-Allow-Origin
*
Server-Timing
dtSInfo;desc="0", dtRpid;desc="1579794406"
Accept-Ranges
bytes
Content-Length
4776
mandtbaltoweb-medium.woff
resources.mtb.com/assets/fonts/ 		63 KB
63 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://resources.mtb.com/assets/fonts/mandtbaltoweb-medium.woff
Requested by
Host: resources.mtb.com
URL: https://resources.mtb.com/r/simple-layout-responsive/css.mtb?v=12082022125000
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
192.216.61.78 East Aurora, United States, ASN12134 (MTB, US),
Reverse DNS
Software
/
Resource Hash
b391b55f950528937beee7687717a4aef81196817834f1c93b099713ff738fbc
Security Headers
Name Value
X-Frame-Options ALLOW-FROM https://mtb.com/

Request headers

Referer
https://resources.mtb.com/r/simple-layout-responsive/css.mtb?v=12082022125000
Origin
http://verifysecurex.dedyn.io
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date
Tue, 20 Dec 2022 01:32:59 GMT
Last-Modified
Fri, 16 Dec 2022 06:37:55 GMT
X-Srv
M-SC-01
ETag
"07a5bee1811d91:0:dtagent10253221019152312ShlF"
X-FRAME-OPTIONS
ALLOW-FROM https://mtb.com/
Content-Type
APPLICATION/X-WOFF
Access-Control-Allow-Origin
*
Server-Timing
dtSInfo;desc="0", dtRpid;desc="-1257662157"
Accept-Ranges
bytes
Content-Length
64318
84abbd53-f2cc-402f-ab9a-f48a947b9630
http://verifysecurex.dedyn.io/ 		165 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:http://verifysecurex.dedyn.io/84abbd53-f2cc-402f-ab9a-f48a947b9630
Requested by
Host: verifysecurex.dedyn.io
URL: http://verifysecurex.dedyn.io/donxx/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
25e521f17135f161c1f02f0555af227292ab009967c461380e3135c414f288e6

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/donxx/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Length
169098
quantum-mtb.js
cdn.quantummetric.com/qscripts/
Redirect Chain
  • http://cdn.quantummetric.com/qscripts/quantum-mtb.js
  • https://cdn.quantummetric.com/qscripts/quantum-mtb.js
264 KB
77 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.quantummetric.com/qscripts/quantum-mtb.js
Requested by
Host: verifysecurex.dedyn.io
URL: http://verifysecurex.dedyn.io/donxx/
Protocol
H2
Server
2606:4700:10::6816:34fc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b5e9d1d823bed82c1a81af06252141e02ba1a1c73c004509329bdd10eb207898
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Tue, 20 Dec 2022 01:33:01 GMT
strict-transport-security
max-age=31536000
content-encoding
br
cf-cache-status
EXPIRED
server
cloudflare
etag
W/"167130423138616680144332671671440403241"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=300, stale-while-revalidate=21600, stale-if-error=21600
cf-ray
77c4a09edff89b88-FRA
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

Date
Tue, 20 Dec 2022 01:33:00 GMT
CF-Cache-Status
EXPIRED
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/html
Location
https://cdn.quantummetric.com/qscripts/quantum-mtb.js
Connection
keep-alive
CF-RAY
77c4a09d1a7a9b5d-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
utag.8.js
tags.tiqcdn.com/utag/mtbank/olb-legacy/prod/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://tags.tiqcdn.com/utag/mtbank/olb-legacy/prod/utag.8.js?utv=ut4.48.202111012113
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/mtbank/olb-legacy/prod/utag.js
Protocol
HTTP/1.1
Server
2.23.192.238 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-23-192-238.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
651c517ff5f016be06ef6497924c898fdbe4dac5a612ae65c407c60e64c8f8b8

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date
Tue, 20 Dec 2022 01:33:00 GMT
Content-Encoding
gzip
Last-Modified
Mon, 01 Nov 2021 21:13:28 GMT
Server
AkamaiNetStorage
ETag
"55e2dafd4e2f01e1da100818637f6e46:1635801208.490581"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=1296000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3522
Expires
Wed, 04 Jan 2023 01:33:00 GMT
s86072793994866
mtb.d1.sc.omtrdc.net/b/ss/mtb/1/JS-2.9.0/
Redirect Chain
  • http://mtb.d1.sc.omtrdc.net/b/ss/mtb/1/JS-2.9.0/s86072793994866?AQB=1&ndh=1&pf=1&t=20%2F11%2F2022%201%3A33%3A0%202%200&ce=UTF-8&pageName=OLB%3ALogin%3AIndex&g=http%3A%2F%2Fverifysecurex.dedyn.io%2F...
  • http://mtb.d1.sc.omtrdc.net/b/ss/mtb/1/JS-2.9.0/s86072793994866?AQB=1&pccr=true&ndh=1&pf=1&t=20%2F11%2F2022%201%3A33%3A0%202%200&ce=UTF-8&pageName=OLB%3ALogin%3AIndex&g=http%3A%2F%2Fverifysecurex.d...
43 B
534 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://mtb.d1.sc.omtrdc.net/b/ss/mtb/1/JS-2.9.0/s86072793994866?AQB=1&pccr=true&ndh=1&pf=1&t=20%2F11%2F2022%201%3A33%3A0%202%200&ce=UTF-8&pageName=OLB%3ALogin%3AIndex&g=http%3A%2F%2Fverifysecurex.dedyn.io%2Fdonxx%2F&cc=USD&c17=Monday%3A8%3A30PM&v19=D%3Dc17&c20=D%3Dg&c21=1&v21=D%3Dg&c22=New&v22=1&c23=Cookies%20Not%20Supported&v23=New&v24=Cookies%20Not%20Supported&v27=D%3DpageName&c41=OLB&v41=OLB&v136=1671499980306&v151=Tealium&s=1600x1200&c=24&j=1.6&v=N&k=N&bw=1600&bh=1200&AQE=1
Requested by
Host: verifysecurex.dedyn.io
URL: http://verifysecurex.dedyn.io/donxx/
Protocol
HTTP/1.1
Server
13.36.218.177 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-36-218-177.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Dec 2022 01:33:00 GMT
x-content-type-options
nosniff
last-modified
Wed, 21 Dec 2022 01:33:00 GMT
server
jag
etag
3589518875272740864-4619743203524614939
vary
*
p3p
CP="This is not a P3P policy"
access-control-allow-origin
*
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0, no-transform, private
content-length
43
x-xss-protection
1; mode=block
expires
Mon, 19 Dec 2022 01:33:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 20 Dec 2022 01:33:00 GMT
x-content-type-options
nosniff
last-modified
Wed, 21 Dec 2022 01:33:00 GMT
server
jag
vary
Origin
p3p
CP="This is not a P3P policy"
access-control-allow-origin
*
location
http://mtb.d1.sc.omtrdc.net/b/ss/mtb/1/JS-2.9.0/s86072793994866?AQB=1&pccr=true&ndh=1&pf=1&t=20%2F11%2F2022%201%3A33%3A0%202%200&ce=UTF-8&pageName=OLB%3ALogin%3AIndex&g=http%3A%2F%2Fverifysecurex.dedyn.io%2Fdonxx%2F&cc=USD&c17=Monday%3A8%3A30PM&v19=D%3Dc17&c20=D%3Dg&c21=1&v21=D%3Dg&c22=New&v22=1&c23=Cookies%20Not%20Supported&v23=New&v24=Cookies%20Not%20Supported&v27=D%3DpageName&c41=OLB&v41=OLB&v136=1671499980306&v151=Tealium&s=1600x1200&c=24&j=1.6&v=N&k=N&bw=1600&bh=1200&AQE=1
content-type
text/plain;charset=utf-8
cache-control
no-cache, no-store, max-age=0, no-transform, private
content-length
0
x-xss-protection
1; mode=block
expires
Mon, 19 Dec 2022 01:33:00 GMT
truncated
/ 		89 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
50e6072d26098d48004a30addeecabd5b22b91e5ccdf9dd86f96459783e3ac23

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/png
js
www.googletagmanager.com/gtag/ 		180 KB
66 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-990489911
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/mtbank/olb-legacy/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
61fa9ae2d05e5f680f203ee604b84c282424c546dd4148267a418682cdfdedb3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Tue, 20 Dec 2022 01:33:00 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
67028
x-xss-protection
0
last-modified
Tue, 20 Dec 2022 00:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 20 Dec 2022 01:33:00 GMT
94112fbf-5523-465d-bbd0-e69ce2569ac8
http://verifysecurex.dedyn.io/ 		2 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:http://verifysecurex.dedyn.io/94112fbf-5523-465d-bbd0-e69ce2569ac8
Requested by
Host: verifysecurex.dedyn.io
URL: http://verifysecurex.dedyn.io/donxx/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1eec5d0bc72fba33ce753f6009a277e07041fb92d221ae5839bbc5e8fff1d0bb

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/donxx/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Length
2479
Content-Type
text/javascript
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/990489911/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/990489911/?random=1671499980584&cv=11&fst=1671499980584&bg=ffffff&guid=ON&async=1&gtm=2oabu0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=http%3A%2F%2Fverifysecurex.dedyn.io%2Fdonxx%2F&tiba=Welcome%20to%20Online%20Banking%20%7C%20M%26T%20Bank&did=dYmQxMT&gdid=dYmQxMT&auid=213888414.1671499981&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-990489911
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
47003d9320ed17b31e7207b1d3ce2856ec39cf10a6a592c0cd0d0412c19035e9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Dec 2022 01:33:00 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
906
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
crossdomain.html
1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/ Frame 1281 		221 B
556 B 		Document
General
Check archive.org
Download Go to
Full URL
https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Requested by
Host: onlinebanking.mtb.com
URL: https://onlinebanking.mtb.com/Assets/js/kessel-client-prod.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:dc00:a:6cdf:4440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer
http://verifysecurex.dedyn.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
71453
content-length
221
content-type
text/html
date
Mon, 19 Dec 2022 05:42:08 GMT
etag
"21e34cf6a03f570df49e212018a567d0"
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
via
1.1 a2eae5bb517678c9d6b43a2731b4462e.cloudfront.net (CloudFront)
x-amz-cf-id
J_4dprLOHshzD8UPkIyOAX3hcGp-KQzOOLVtotprYOu6qa5qCM2Pig==
x-amz-cf-pop
FRA56-P6
x-amz-version-id
null
x-cache
Hit from cloudfront
crossdomain.html
1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/ Frame 4B1D 		221 B
556 B 		Document
General
Check archive.org
Download Go to
Full URL
https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Requested by
Host: onlinebanking.mtb.com
URL: https://onlinebanking.mtb.com/Assets/js/kessel-client-prod.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223f:4200:1e:54f1:26c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer
http://verifysecurex.dedyn.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
85381
content-length
221
content-type
text/html
date
Mon, 19 Dec 2022 01:50:00 GMT
etag
"21e34cf6a03f570df49e212018a567d0"
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-id
gkSHHFgtABaBUCDYmK8-WwghIRcGQu0UpuBNcpaebZqXFAsQoBhFXw==
x-amz-cf-pop
FRA56-P5
x-amz-version-id
null
x-cache
Hit from cloudfront
crossdomain.html
1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/ Frame 8CC7 		221 B
557 B 		Document
General
Check archive.org
Download Go to
Full URL
https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Requested by
Host: onlinebanking.mtb.com
URL: https://onlinebanking.mtb.com/Assets/js/kessel-client-prod.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:f600:13:ab57:d440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer
http://verifysecurex.dedyn.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
71376
content-length
221
content-type
text/html
date
Mon, 19 Dec 2022 05:43:25 GMT
etag
"21e34cf6a03f570df49e212018a567d0"
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
via
1.1 1662abbf731d8832e73c83b2467e7f38.cloudfront.net (CloudFront)
x-amz-cf-id
5LAxUjv6YkfO28_Dcnw2_U9XG35z1QXI-kSYvfEah8jNpMoZfCNKow==
x-amz-cf-pop
FRA60-P2
x-amz-version-id
null
x-cache
Hit from cloudfront
crossdomain2.12.0.5273.b96c35cc.min.js
1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/ Frame 4B1D 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by
Host: 1.b406929acabac9b095f124c81bdfcf57f.com
URL: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223f:4200:1e:54f1:26c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 19 Dec 2022 01:50:00 GMT
x-amz-version-id
null
via
1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P5
age
85381
etag
"9ee48a4da9c402e8a23ad085fb71f28f"
x-cache
Hit from cloudfront
content-type
application/javascript
accept-ranges
bytes
content-length
3227
x-amz-cf-id
d0dXABn3yo_pJt1zXrNlqHaBKyDL48n746Bp7hPB_EQMQ1tsXNr1LA==
crossdomain2.12.0.5273.b96c35cc.min.js
1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/ Frame 8CC7 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by
Host: 1.c81358859121583b7adf2ace89cb39f44.com
URL: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:f600:13:ab57:d440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 19 Dec 2022 02:24:38 GMT
x-amz-version-id
null
via
1.1 1662abbf731d8832e73c83b2467e7f38.cloudfront.net (CloudFront)
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P2
age
83303
etag
"9ee48a4da9c402e8a23ad085fb71f28f"
x-cache
Hit from cloudfront
content-type
application/javascript
accept-ranges
bytes
content-length
3227
x-amz-cf-id
q_Wh_thgh06QGozbAz3Kdeu3Xy7-OIGHnlGZEXXVx0gK-tR_6XMKSQ==
crossdomain2.12.0.5273.b96c35cc.min.js
1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/ Frame 1281 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by
Host: 1.a79ab95c1589a13f8a4cab612bc71f9f7.com
URL: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:dc00:a:6cdf:4440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-amz-version-id
null
date
Mon, 19 Dec 2022 04:07:52 GMT
via
1.1 a2eae5bb517678c9d6b43a2731b4462e.cloudfront.net (CloudFront)
last-modified
Tue, 13 Oct 2020 12:04:25 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P6
age
77109
etag
"9ee48a4da9c402e8a23ad085fb71f28f"
x-cache
Hit from cloudfront
content-type
application/javascript
accept-ranges
bytes
content-length
3227
x-amz-cf-id
ayawnXzcVBkhElUr2rI2xHJVG0tD0ArdD7lwhJ5ufPztTM9Oj2D8lQ==
/
www.google.com/pagead/1p-user-list/990489911/ 		42 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/990489911/?random=1671499980584&cv=11&fst=1671498000000&bg=ffffff&guid=ON&async=1&gtm=2oabu0&u_w=1600&u_h=1200&frm=0&url=http%3A%2F%2Fverifysecurex.dedyn.io%2Fdonxx%2F&tiba=Welcome%20to%20Online%20Banking%20%7C%20M%26T%20Bank&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1597663130&rmt_tld=0&ipr=y
Requested by
Host: verifysecurex.dedyn.io
URL: http://verifysecurex.dedyn.io/donxx/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Dec 2022 01:33:01 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/990489911/ 		42 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/990489911/?random=1671499980584&cv=11&fst=1671498000000&bg=ffffff&guid=ON&async=1&gtm=2oabu0&u_w=1600&u_h=1200&frm=0&url=http%3A%2F%2Fverifysecurex.dedyn.io%2Fdonxx%2F&tiba=Welcome%20to%20Online%20Banking%20%7C%20M%26T%20Bank&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1597663130&rmt_tld=1&ipr=y
Requested by
Host: verifysecurex.dedyn.io
URL: http://verifysecurex.dedyn.io/donxx/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Dec 2022 01:33:01 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dde727a0-e481-4102-86d7-ab252c262b71
http://verifysecurex.dedyn.io/ 		17 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:http://verifysecurex.dedyn.io/dde727a0-e481-4102-86d7-ab252c262b71
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1a7e97aaa0c577277230ad6138c113e6adccdecb78ec1495138ad23e129eb5d3

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://verifysecurex.dedyn.io/donxx/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Length
17224
Content-Type
application/javascript
/
mtb-app.quantummetric.com/ Frame 42CD 		90 B
915 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mtb-app.quantummetric.com/?T=B&u=http%3A%2F%2Fverifysecurex.dedyn.io%2Fdonxx%2F&t=1671499981575&v=1671499982082&z=1&S=0&N=0&P=0
Requested by
Host: cdn.quantummetric.com
URL: http://cdn.quantummetric.com/qscripts/quantum-mtb.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.67.142.127 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
127.142.67.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
e6e32118ce7361c59f3180ea079c299426924babdf3748fdc079025729e732f6
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Dec 2022 01:33:02 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
content-encoding
gzip
content-security-policy
default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
http://verifysecurex.dedyn.io
access-control-allow-credentials
true
x-robots-tag
noindex
/
mtb-app.quantummetric.com/ Frame 42CD 		0
650 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mtb-app.quantummetric.com/?T=B&u=http%3A%2F%2Fverifysecurex.dedyn.io%2Fdonxx%2F&t=1671499981575&v=1671499982088&z=1&Q=1&Y=1&X=ae52dc9351cf4cfa49cf37d76c99c05b
Requested by
Host: cdn.quantummetric.com
URL: http://cdn.quantummetric.com/qscripts/quantum-mtb.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.67.142.127 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
127.142.67.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Dec 2022 01:33:02 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
content-security-policy
default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
server
nginx
content-type
application/json
access-control-allow-origin
http://verifysecurex.dedyn.io
access-control-allow-credentials
true
x-robots-tag
noindex
content-length
0
/
mtb-app.quantummetric.com/ Frame 42CD 		28 B
736 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mtb-app.quantummetric.com/?s=654f20c107d574cd4d800579014335f1&H=6679b16a4b387bd68bfa6c9d&Q=3
Requested by
Host: cdn.quantummetric.com
URL: http://cdn.quantummetric.com/qscripts/quantum-mtb.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.67.142.127 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
127.142.67.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
12d77f615d7df0946899d769baa6094c8060d6006df35a1afb54c152b070871e
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Tue, 20 Dec 2022 01:33:02 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
content-encoding
gzip
content-security-policy
default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
http://verifysecurex.dedyn.io
access-control-allow-credentials
true
x-robots-tag
noindex
/
mtb-app.quantummetric.com/ Frame 42CD 		0
650 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mtb-app.quantummetric.com/?T=B&u=http%3A%2F%2Fverifysecurex.dedyn.io%2Fdonxx%2F&t=1671499981575&v=1671499982584&H=6679b16a4b387bd68bfa6c9d&s=654f20c107d574cd4d800579014335f1&U=86313bd6694fd1b71444072d30c744ed&z=1&Q=2&S=0&N=0
Requested by
Host: cdn.quantummetric.com
URL: http://cdn.quantummetric.com/qscripts/quantum-mtb.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.67.142.127 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
127.142.67.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Dec 2022 01:33:02 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
content-security-policy
default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
server
nginx
content-type
application/json
access-control-allow-origin
http://verifysecurex.dedyn.io
access-control-allow-credentials
true
x-robots-tag
noindex
content-length
0
rb_edeadee0-0165-4b9e-a91f-0085183ac4e1
verifysecurex.dedyn.io/ 		1 KB
1016 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://verifysecurex.dedyn.io/rb_edeadee0-0165-4b9e-a91f-0085183ac4e1?type=js3&sn=v_4_srv_-2D30_sn_SKE88KC91U9N58NM3A36FFSHGHS9AAS1&svrid=-30&flavor=post&vi=APKAAWHEHCIEOHPWWPSLSEKIHPMJCTFD-0&modifiedSince=1671249446533&rf=http%3A%2F%2Fverifysecurex.dedyn.io%2Fdonxx%2F&bp=3&app=893c324bd7e5ac65&crc=422785606&en=zgefxirc&end=1
Requested by
Host: onlinebanking.mtb.com
URL: https://onlinebanking.mtb.com/Assets/js/mtb_app_wbk.js
Protocol
HTTP/1.1
Server
194.49.94.116 Frankfurt am Main, Germany, ASN211252 (AS_DELIS, US),
Reverse DNS
Software
nginx /
Resource Hash
d1847f89945dc03640fa8d0dad24f2d9a9282862c19b27928201025bcca0eb98

Request headers

Referer
http://verifysecurex.dedyn.io/donxx/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Tue, 20 Dec 2022 01:33:02 GMT
Content-Encoding
gzip
Last-Modified
Mon, 19 Dec 2022 20:48:24 GMT
Server
nginx
ETag
W/"5a1-5f03470be860f"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/html
Connection
keep-alive
/
mtb-app.quantummetric.com/ Frame 42CD 		0
650 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mtb-app.quantummetric.com/?T=B&u=http%3A%2F%2Fverifysecurex.dedyn.io%2Fdonxx%2F&t=1671499981575&v=1671499982711&H=6679b16a4b387bd68bfa6c9d&s=654f20c107d574cd4d800579014335f1&z=1&S=616&N=2&P=1
Requested by
Host: cdn.quantummetric.com
URL: http://cdn.quantummetric.com/qscripts/quantum-mtb.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.67.142.127 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
127.142.67.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Dec 2022 01:33:02 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
content-security-policy
default-src 'self' *.quantummetric.com; connect-src * ws:; frame-src * data: blob:; font-src * data: blob:; img-src * data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.quantummetric.com https://app.getbeamer.com https://backend.getbeamer.com https://realtime.getbeamer.com https://static.getbeamer.com https://ajax.googleapis.com https://static.zdassets.com https://*.appcues.com https://*.appcues.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' *.quantummetric.com https://fonts.googleapis.com https://app.getbeamer.com https://*.appcues.com https://*.appcues.net;
server
nginx
content-type
application/json
access-control-allow-origin
http://verifysecurex.dedyn.io
access-control-allow-credentials
true
x-robots-tag
noindex
content-length
0
rb_edeadee0-0165-4b9e-a91f-0085183ac4e1
verifysecurex.dedyn.io/ 		1 KB
1016 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://verifysecurex.dedyn.io/rb_edeadee0-0165-4b9e-a91f-0085183ac4e1?type=js3&sn=v_4_srv_-2D30_sn_SKE88KC91U9N58NM3A36FFSHGHS9AAS1&svrid=-30&flavor=post&vi=APKAAWHEHCIEOHPWWPSLSEKIHPMJCTFD-0&modifiedSince=1671249446533&rf=http%3A%2F%2Fverifysecurex.dedyn.io%2Fdonxx%2F&bp=3&app=893c324bd7e5ac65&crc=3497163173&en=zgefxirc&end=1
Requested by
Host: onlinebanking.mtb.com
URL: https://onlinebanking.mtb.com/Assets/js/mtb_app_wbk.js
Protocol
HTTP/1.1
Server
194.49.94.116 Frankfurt am Main, Germany, ASN211252 (AS_DELIS, US),
Reverse DNS
Software
nginx /
Resource Hash
d1847f89945dc03640fa8d0dad24f2d9a9282862c19b27928201025bcca0eb98

Request headers

Referer
http://verifysecurex.dedyn.io/donxx/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Tue, 20 Dec 2022 01:33:04 GMT
Content-Encoding
gzip
Last-Modified
Mon, 19 Dec 2022 20:48:24 GMT
Server
nginx
ETag
W/"5a1-5f03470be860f"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/html
Connection
keep-alive

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
onlinebanking.mtb.com
URL
https://onlinebanking.mtb.com/TSPD/0856addebbab200038d7ae08cdade4c837e7f1d49e5435ee587b4dcec3e62d370319177decab29bc?type=9
Domain
onlinebanking.mtb.com
URL
https://onlinebanking.mtb.com/TSPD/0856addebbab200038d7ae08cdade4c837e7f1d49e5435ee587b4dcec3e62d370319177decab29bc?type=17

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: M&T Bank (Banking)

96 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| UIEvent object| oncontentvisibilityautostatechange boolean| ikhD object| iz object| dT_ object| dtrum object| dynatrace string| APPID object| List object| s function| Hashtable function| startsWith function| DomDataCollection function| IE_FingerPrint function| Mozilla_FingerPrint function| Opera_FingerPrint function| Timer function| getRandomPort object| ProxyCollector function| BlackberryLocationCollector function| detectFields string| SEP string| PAIR string| DEV function| FingerPrint function| urlEncode function| encode_deviceprint function| decode_deviceprint function| post_deviceprint function| post_fingerprints function| add_deviceprint function| form_add_data function| form_add_deviceprint string| HTML5 string| BLACKBERRY string| UNDEFINED string| GEO_LOCATION_DEFAULT_STRUCT object| geoLocator boolean| geoLocatorStatus function| detectDeviceCollectionAPIMode function| init function| startCollection function| stopCollection function| getGeolocationStruct function| HTML5LocationCollector object| UIEventCollector function| InteractionElement function| UIElementList function| activeXDetect function| stripIllegalChars function| stripFullPath object| BrowserDetect function| convertTimestampToGMT function| getTimestampInMillis function| debug function| $ function| forceIE89Synchronicity boolean| utag_condload object| utag function| AppMeasurement function| s_gi function| s_pgicq function| AppMeasurement_Module_Integrate function| AppMeasurement_Module_ActivityMap boolean| __tealium_twc_switch object| s_c_il number| s_c_in number| s_objectID number| s_giq object| cdwpb object| cdApi string| k object| dc object| fl object| cd number| utc object| tz number| thisy number| thish number| thismin number| thisd string| f0 string| targetRTFiredWithPV object| s_i_mtb string| gtagRename object| dataLayer function| gtag object| google_tag_manager object| google_tag_data object| GooglebQhCsO function| QuantumMetricInstrumentationStart object| QuantumMetricAPI number| QMAdminScriptErrorId function| qmflate function| _QuantumMetricSymbol

15 Cookies

Domain/Path Name / Value
.verifysecurex.dedyn.io/ Name: dtCookie
Value: v_4_srv_-2D30_sn_SKE88KC91U9N58NM3A36FFSHGHS9AAS1
.verifysecurex.dedyn.io/ Name: rxVisitor
Value: 1671499979626AAQ1LTPHFQPLM4MR53G32AN9QOTMRDVG
.verifysecurex.dedyn.io/ Name: dtLatC
Value: 13
.verifysecurex.dedyn.io/ Name: dtSa
Value: -
.verifysecurex.dedyn.io/ Name: bmuid
Value: 1671499980278-A45B98C5-78A4-41DE-A5DC-C9D4B2BED396
.verifysecurex.dedyn.io/ Name: cdContextId
Value: 2
.verifysecurex.dedyn.io/ Name: _gcl_au
Value: 1.1.213888414.1671499981
.verifysecurex.dedyn.io/ Name: cdSNum
Value: 1671499980641-sjn0000109-05d624c2-b0af-412b-b0a8-2a09fc4e90cb
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.verifysecurex.dedyn.io/ Name: rxvt
Value: 1671501781489|1671499979627
.verifysecurex.dedyn.io/ Name: dtPC
Value: -30$499979624_175h-vAPKAAWHEHCIEOHPWWPSLSEKIHPMJCTFD-0e0
mtb-app.quantummetric.com/ Name: s
Value: 654f20c107d574cd4d800579014335f1
mtb-app.quantummetric.com/ Name: U
Value: 86313bd6694fd1b71444072d30c744ed
.verifysecurex.dedyn.io/ Name: QuantumMetricSessionID
Value: 654f20c107d574cd4d800579014335f1
.verifysecurex.dedyn.io/ Name: QuantumMetricUserID
Value: 86313bd6694fd1b71444072d30c744ed

6 Console Messages

Source Level URL
Text
network error URL: https://onlinebanking.mtb.com/TSPD/0856addebbab200038d7ae08cdade4c837e7f1d49e5435ee587b4dcec3e62d370319177decab29bc?type=9
Message:
Failed to load resource: net::ERR_CONNECTION_RESET
network error URL: https://onlinebanking.mtb.com/TSPD/0856addebbab200038d7ae08cdade4c837e7f1d49e5435ee587b4dcec3e62d370319177decab29bc?type=17
Message:
Failed to load resource: net::ERR_CONNECTION_RESET
rendering warning URL: https://onlinebanking.mtb.com/Assets/js/mtb_app_wbk.js
Message:
Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
rendering warning URL: https://onlinebanking.mtb.com/Assets/js/mtb_app_wbk.js
Message:
Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
network error URL: http://verifysecurex.dedyn.io/rb_edeadee0-0165-4b9e-a91f-0085183ac4e1?type=js3&sn=v_4_srv_-2D30_sn_SKE88KC91U9N58NM3A36FFSHGHS9AAS1&svrid=-30&flavor=post&vi=APKAAWHEHCIEOHPWWPSLSEKIHPMJCTFD-0&modifiedSince=1671249446533&rf=http%3A%2F%2Fverifysecurex.dedyn.io%2Fdonxx%2F&bp=3&app=893c324bd7e5ac65&crc=422785606&en=zgefxirc&end=1
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: http://verifysecurex.dedyn.io/rb_edeadee0-0165-4b9e-a91f-0085183ac4e1?type=js3&sn=v_4_srv_-2D30_sn_SKE88KC91U9N58NM3A36FFSHGHS9AAS1&svrid=-30&flavor=post&vi=APKAAWHEHCIEOHPWWPSLSEKIHPMJCTFD-0&modifiedSince=1671249446533&rf=http%3A%2F%2Fverifysecurex.dedyn.io%2Fdonxx%2F&bp=3&app=893c324bd7e5ac65&crc=3497163173&en=zgefxirc&end=1
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1.a79ab95c1589a13f8a4cab612bc71f9f7.com
1.b406929acabac9b095f124c81bdfcf57f.com
1.c81358859121583b7adf2ace89cb39f44.com
cdn.quantummetric.com
googleads.g.doubleclick.net
mtb-app.quantummetric.com
mtb.d1.sc.omtrdc.net
onlinebanking.mtb.com
resources.mtb.com
tags.tiqcdn.com
verifysecurex.dedyn.io
www.google.com
www.google.de
www.googletagmanager.com
onlinebanking.mtb.com
13.36.218.177
192.216.61.78
194.49.94.116
2.23.192.238
24.75.29.69
2600:9000:223f:4200:1e:54f1:26c0:93a1
2600:9000:2250:f600:13:ab57:d440:93a1
2600:9000:2490:dc00:a:6cdf:4440:93a1
2606:4700:10::6816:34fc
2606:4700:10::ac43:149e
2a00:1450:4001:813::2008
2a00:1450:4001:827::2004
2a00:1450:4001:830::2002
2a00:1450:4001:831::2003
34.67.142.127
0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6
0dc8244726314592a0fc6e67259c596a0d89160f844cf6cad576a78ce3331f87
108d16421ae2ff7fc5157d507dc5b1bf7f62140ba58cf3c723b1f2b7e74c21df
12d77f615d7df0946899d769baa6094c8060d6006df35a1afb54c152b070871e
1a7e97aaa0c577277230ad6138c113e6adccdecb78ec1495138ad23e129eb5d3
1eec5d0bc72fba33ce753f6009a277e07041fb92d221ae5839bbc5e8fff1d0bb
25e521f17135f161c1f02f0555af227292ab009967c461380e3135c414f288e6
4029a5a081992259f4e529190b49dbba893931da4e843dd203449f1b9a4509d2
47003d9320ed17b31e7207b1d3ce2856ec39cf10a6a592c0cd0d0412c19035e9
50e6072d26098d48004a30addeecabd5b22b91e5ccdf9dd86f96459783e3ac23
5f5b0d9f678fe446631a33a4cbbe891a01b0ed972143702e67ae6617367096ac
61fa9ae2d05e5f680f203ee604b84c282424c546dd4148267a418682cdfdedb3
651c517ff5f016be06ef6497924c898fdbe4dac5a612ae65c407c60e64c8f8b8
6ef98ef294d03000d904d5f868598dc98667a0d00338cee40b3080a9d725d1cd
72090ef4a2e4ceb1c58a57cf49a6ff27601b51aae2479b3bfb8cc12a791a6f54
76326e2beb8d7a9ebf598e12e0b5d927654bde867b37ae4d890337218895c42f
79feb75fef9778bdc2fe775ed5e1aad4308c2312ecec0825409c161b6e5f2903
913b1bf2f19b8b9943e12461323a4368f5bed8c01108cb1e72a9f128c89c03f2
9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
b2ef3bd17aa6bc2daa7b1209f7848b30c64f3068e43162b09a216639ab430ce5
b391b55f950528937beee7687717a4aef81196817834f1c93b099713ff738fbc
b5e9d1d823bed82c1a81af06252141e02ba1a1c73c004509329bdd10eb207898
bcc41de3276fb2e7cf0be64b6a62e5306e18efbf14efa5379c1d89acad6ffc2a
d1847f89945dc03640fa8d0dad24f2d9a9282862c19b27928201025bcca0eb98
d58eb2802f72d0c6b1d944a1335e8fb914af44b51fe16097aad994c15b8cfbad
da505e58bfb9de59f6c56ef0f0ceb296d42d3682ea25f8b75620621d8f4cdcb5
df06d64b1b7dfce7398d5b8db3361da96b36b8e980fcaa1f2fdf8a4f6f2b2347
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6e32118ce7361c59f3180ea079c299426924babdf3748fdc079025729e732f6
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f78201bc5207eca0e7c28127849178c04dfbac606927804c31f6af106b02e266