terapiaespecializada.es Open in urlscan Pro
5.135.199.226 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://terapiaespecializada.es/mtb/app/auth.php
Submission: On March 02 via automatic, source openphish (March 2nd 2023, 1:24:43 am UTC) — Scanned from ES

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 5.135.199.226, located in Lugo, Spain and belongs to OVH, FR. The main domain is terapiaespecializada.es.
TLS certificate: Issued by R3 on February 4th 2023. Valid for: 3 months.

This is the only time terapiaespecializada.es was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: M&T Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
9	5.135.199.226 5.135.199.226	16276 (OVH) (OVH)
1	13.35.166.114 13.35.166.114	16509 (AMAZON-02) (AMAZON-02)
10	2

9 5.135.199.226 (Lugo, Spain)

ASN16276 (OVH, FR)
PTR: zimbra.lackestuc.es

terapiaespecializada.es	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.166.114 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-166-114.tpe50.r.cloudfront.net

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	terapiaespecializada.es terapiaespecializada.es	180 KB
1	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 2969	449 B
10	2

	Domain	Requested by
9	terapiaespecializada.es	terapiaespecializada.es
1	nexus.ensighten.com	terapiaespecializada.es
10	2

This site contains no links.

Subject Issuer	Validity	Valid
terapiaespecializada.es R3	`2023-02-04` - `2023-05-05`	3 months	crt.sh
nexus.ensighten.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-07` - `2023-10-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://terapiaespecializada.es/mtb/app/auth.php
Frame ID: 6FAF51E43846DAA6EA57826E6B675B04
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Welcome to Online Banking | M&T Bank

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

180 kB
Transfer

453 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request auth.php Show response
terapiaespecializada.es/mtb/app/ 12 KB
3 KB 241ms
54ms Document
text/html 5.135.199.226
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://terapiaespecializada.es/mtb/app/auth.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.135.199.226 Lugo, Spain, ASN16276 (OVH, FR),

Reverse DNS

zimbra.lackestuc.es

Software

nginx / PHP/7.2.34

Resource Hash

759509f6138fe9e43b2a29a81f276a1e61da44f19ebd99dccde0441549dfe65d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: es-ES,es;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-type: text/html; charset=UTF-8
date: Thu, 02 Mar 2023 01:24:38 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-powered-by: PHP/7.2.34

GET
H2 200 mtb.css
terapiaespecializada.es/mtb/libraries/css/ 252 KB
25 KB 107ms
107ms Stylesheet
text/css 5.135.199.226
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://terapiaespecializada.es/mtb/libraries/css/mtb.css

Requested by

Host: terapiaespecializada.es
URL: https://terapiaespecializada.es/mtb/app/auth.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.135.199.226 Lugo, Spain, ASN16276 (OVH, FR),

Reverse DNS

zimbra.lackestuc.es

Software

nginx /

Resource Hash

d18b82a04723d0bdf0124a010cdc5c916fa42efd52309d49838255a483f35146

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://terapiaespecializada.es/mtb/app/auth.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 01:24:38 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Sat, 13 Feb 2021 18:38:44 GMT
server: nginx
etag: W/"60281cb4-3f03d"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 Bootstrap.js Show response
terapiaespecializada.es/mtb/libraries/js/ 52 KB
15 KB 108ms
108ms Script
application/javascript 5.135.199.226
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://terapiaespecializada.es/mtb/libraries/js/Bootstrap.js

Requested by

Host: terapiaespecializada.es
URL: https://terapiaespecializada.es/mtb/app/auth.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.135.199.226 Lugo, Spain, ASN16276 (OVH, FR),

Reverse DNS

zimbra.lackestuc.es

Software

nginx /

Resource Hash

b080e4b98b9a6a6a8a95a0034c7aa46fd054f5a67873912ff6107f934b7553f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://terapiaespecializada.es/mtb/app/auth.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 01:24:38 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Sat, 13 Feb 2021 17:41:02 GMT
server: nginx
etag: W/"60280f2e-d0c7"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 mtb-logo.svg
terapiaespecializada.es/mtb/libraries/img/ 2 KB
1 KB 93ms
92ms Image
image/svg+xml 5.135.199.226
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://terapiaespecializada.es/mtb/libraries/img/mtb-logo.svg

Requested by

Host: terapiaespecializada.es
URL: https://terapiaespecializada.es/mtb/app/auth.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.135.199.226 Lugo, Spain, ASN16276 (OVH, FR),

Reverse DNS

zimbra.lackestuc.es

Software

nginx /

Resource Hash

5f5b0d9f678fe446631a33a4cbbe891a01b0ed972143702e67ae6617367096ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://terapiaespecializada.es/mtb/app/auth.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 01:24:39 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Sat, 13 Feb 2021 17:41:02 GMT
server: nginx
etag: W/"60280f2e-7f7"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 mtb-equalhousinglender.svg
terapiaespecializada.es/mtb/libraries/img/ 230 B
391 B 93ms
92ms Image
image/svg+xml 5.135.199.226
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://terapiaespecializada.es/mtb/libraries/img/mtb-equalhousinglender.svg

Requested by

Host: terapiaespecializada.es
URL: https://terapiaespecializada.es/mtb/app/auth.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.135.199.226 Lugo, Spain, ASN16276 (OVH, FR),

Reverse DNS

zimbra.lackestuc.es

Software

nginx /

Resource Hash

d58eb2802f72d0c6b1d944a1335e8fb914af44b51fe16097aad994c15b8cfbad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://terapiaespecializada.es/mtb/app/auth.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 01:24:39 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Sat, 13 Feb 2021 17:41:02 GMT
server: nginx
etag: W/"60280f2e-e6"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 mtb-entrust.svg
terapiaespecializada.es/mtb/libraries/img/ 1 KB
916 B 93ms
93ms Image
image/svg+xml 5.135.199.226
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://terapiaespecializada.es/mtb/libraries/img/mtb-entrust.svg

Requested by

Host: terapiaespecializada.es
URL: https://terapiaespecializada.es/mtb/app/auth.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.135.199.226 Lugo, Spain, ASN16276 (OVH, FR),

Reverse DNS

zimbra.lackestuc.es

Software

nginx /

Resource Hash

b2ef3bd17aa6bc2daa7b1209f7848b30c64f3068e43162b09a216639ab430ce5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://terapiaespecializada.es/mtb/app/auth.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 01:24:39 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Sat, 13 Feb 2021 17:41:02 GMT
server: nginx
etag: W/"60280f2e-545"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/mtbank/OE-Prod/ 60 B
449 B 773ms
283ms Script
application/javascript 13.35.166.114
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/mtbank/OE-Prod/serverComponent.php?r=51.06846223795915&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/mtbank/OE-Prod/code/&publishedOn=Wed%20Feb%2003%2022:07:37%20GMT%202021&ClientID=1512&PageID=https%3A%2F%2Fterapiaespecializada.es%2Fmtb%2Fapp%2Fauth.php
Requested by: Host: terapiaespecializada.es
URL: https://terapiaespecializada.es/mtb/libraries/js/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.166.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-166-114.tpe50.r.cloudfront.net
Software: CloudFront /
Resource Hash: ad68c8c7e80948313b864c7f1f78556234fe7d5fc778337a7bf0db2efd0c7468

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://terapiaespecializada.es/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 01:24:39 GMT
via: 1.1 86d025c89ad18e16ad8b1972120c332a.cloudfront.net (CloudFront)
last-modified: Thu, 08 Sep 2022 01:40:18 GMT
server: CloudFront
x-amz-cf-pop: TPE50-C1
etag: "63194802-3c"
x-cache: Miss from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 60
x-amz-cf-id: aon5Lr5AIhfkNR4gZTZfmcy10eDHfulEiXR0rVSXO1ZSZ5-LCxOLdg==
expires: Thu, 02 Mar 2023 01:24:38 GMT

GET
H2 200 mandtpg-iconfont.woff
terapiaespecializada.es/mtb/libraries/fonts/ 5 KB
5 KB 54ms
53ms Font
font/woff 5.135.199.226
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://terapiaespecializada.es/mtb/libraries/fonts/mandtpg-iconfont.woff

Requested by

Host: terapiaespecializada.es
URL: https://terapiaespecializada.es/mtb/libraries/css/mtb.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.135.199.226 Lugo, Spain, ASN16276 (OVH, FR),

Reverse DNS

zimbra.lackestuc.es

Software

nginx /

Resource Hash

108d16421ae2ff7fc5157d507dc5b1bf7f62140ba58cf3c723b1f2b7e74c21df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://terapiaespecializada.es/mtb/libraries/css/mtb.css
Origin: https://terapiaespecializada.es
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 01:24:39 GMT
strict-transport-security: max-age=31536000
last-modified: Sat, 13 Feb 2021 18:25:06 GMT
server: nginx
etag: "60281982-12a8"
content-type: font/woff
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 4776
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 mandtbaltoweb-book.woff
terapiaespecializada.es/mtb/libraries/fonts/ 66 KB
66 KB 54ms
54ms Font
font/woff 5.135.199.226
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://terapiaespecializada.es/mtb/libraries/fonts/mandtbaltoweb-book.woff

Requested by

Host: terapiaespecializada.es
URL: https://terapiaespecializada.es/mtb/libraries/css/mtb.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.135.199.226 Lugo, Spain, ASN16276 (OVH, FR),

Reverse DNS

zimbra.lackestuc.es

Software

nginx /

Resource Hash

4029a5a081992259f4e529190b49dbba893931da4e843dd203449f1b9a4509d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://terapiaespecializada.es/mtb/libraries/css/mtb.css
Origin: https://terapiaespecializada.es
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 01:24:39 GMT
strict-transport-security: max-age=31536000
last-modified: Sat, 13 Feb 2021 18:24:34 GMT
server: nginx
etag: "60281962-10857"
content-type: font/woff
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 67671
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 mandtbaltoweb-medium.woff
terapiaespecializada.es/mtb/libraries/fonts/ 63 KB
63 KB 105ms
105ms Font
font/woff 5.135.199.226
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://terapiaespecializada.es/mtb/libraries/fonts/mandtbaltoweb-medium.woff

Requested by

Host: terapiaespecializada.es
URL: https://terapiaespecializada.es/mtb/libraries/css/mtb.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.135.199.226 Lugo, Spain, ASN16276 (OVH, FR),

Reverse DNS

zimbra.lackestuc.es

Software

nginx /

Resource Hash

b391b55f950528937beee7687717a4aef81196817834f1c93b099713ff738fbc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://terapiaespecializada.es/mtb/libraries/css/mtb.css
Origin: https://terapiaespecializada.es
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 01:24:39 GMT
strict-transport-security: max-age=31536000
last-modified: Sat, 13 Feb 2021 18:24:48 GMT
server: nginx
etag: "60281970-fb3e"
content-type: font/woff
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 64318
expires: Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: M&T Bank (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| ensBootstraps object| Bootstrapper

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			terapiaespecializada.es/	1969-12-31 23:59:59	Name: PHPSESSID Value: fl63hupevfllqcs3t756o34qd4

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

nexus.ensighten.com
terapiaespecializada.es
13.35.166.114
5.135.199.226
108d16421ae2ff7fc5157d507dc5b1bf7f62140ba58cf3c723b1f2b7e74c21df
4029a5a081992259f4e529190b49dbba893931da4e843dd203449f1b9a4509d2
5f5b0d9f678fe446631a33a4cbbe891a01b0ed972143702e67ae6617367096ac
759509f6138fe9e43b2a29a81f276a1e61da44f19ebd99dccde0441549dfe65d
ad68c8c7e80948313b864c7f1f78556234fe7d5fc778337a7bf0db2efd0c7468
b080e4b98b9a6a6a8a95a0034c7aa46fd054f5a67873912ff6107f934b7553f4
b2ef3bd17aa6bc2daa7b1209f7848b30c64f3068e43162b09a216639ab430ce5
b391b55f950528937beee7687717a4aef81196817834f1c93b099713ff738fbc
d18b82a04723d0bdf0124a010cdc5c916fa42efd52309d49838255a483f35146
d58eb2802f72d0c6b1d944a1335e8fb914af44b51fe16097aad994c15b8cfbad

terapiaespecializada.es Open in urlscan Pro 5.135.199.226 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

180 kBTransfer

453 kBSize

1 Cookies

0 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

terapiaespecializada.es Open in urlscan Pro
5.135.199.226 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

180 kB
Transfer

453 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!