Report - www.levuneshama.com/dirmtb/verif.php

Report Overview

Submitted URL
www.levuneshama.com/dirmtb/verif.php
IP
212.115.111.178
ASN
#44709 O.m.c. Computers & Communications Ltd
Submitted
2022-09-25 21:43:21
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
60

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	329 B	737 B	93.184.220.29
www.levuneshama.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	13 kB	168 kB	212.115.111.178
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.6 kB	26 kB	34.120.237.76
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	978 B	2.7 kB	23.36.76.226
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	401 B	5.8 kB	143.204.55.25
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	321 B	229 B	34.117.237.239
ocsp.comodoca.com	1696	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	329 B	1.0 kB	172.64.155.188
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	758 B	2.7 kB	143.204.55.115
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	594 B	127 B	34.212.13.96

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2022-09-25	medium	www.levuneshama.com/dirmtb/verif.php	M & T Bank Coporation

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-09-25	medium	www.levuneshama.com/assets/fonts/mandtbaltoweb-book.woff	Malware
2022-09-25	medium	www.levuneshama.com/assets/fonts/mandtbaltoweb-medium.woff	Malware
2022-09-25	medium	www.levuneshama.com/dirmtb/verif.php	Malware

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed
2022-09-25	medium	levuneshama.com	Sinkholed

JavaScript (9)

	URL	Size	First Seen	Last Seen
	www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/b9ce03ceb3f06b3602497b84c93c31ac.js.download	8.3 kB	2023-03-07	2024-04-16
Pretty URL www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/b9ce03ceb3f06b3602497b84c93c31ac.js.download IP 212.115.111.178 ASN #44709 O.m.c. Computers & Communications Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:24:29 Last Seen2024-04-16 19:41:30 Times Seen36 Hash 46a7c4d6d96105dabc6ee98f102812ce e8ffb98936c7a1ad75f788f05a4b1639934f5853 4c7e2cc8c50ab082334a9d91a8e42018086791fe8170a050628db9c364467d1a Loading...

	www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/mtb-app.js.download	1.8 kB	2023-03-07	2024-04-16
Pretty URL www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/mtb-app.js.download IP 212.115.111.178 ASN #44709 O.m.c. Computers & Communications Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:24:29 Last Seen2024-04-16 19:41:30 Times Seen23 Hash 6e033fba8231adf6d98131b9942afae9 fd51ea17e5a50748ec341bc18297f9651ec0054a 5d20a0079750e45abe7ab6e246703d1666ba7065e62a0767b16735684f16702e Loading...

	www.levuneshama.com/dirmtb/verif.php	4.6 kB	2023-03-07	2024-04-16
Pretty URL www.levuneshama.com/dirmtb/verif.php IP 212.115.111.178 ASN #44709 O.m.c. Computers & Communications Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:18 Last Seen2024-04-16 19:41:30 Times Seen14 Hash b193d0e7e4e09f305dfe6a35ebbb1d82 2d24fccbc16d059ba0435183260880a00039feb5 c21ec6cd673a9c056d4b250533ce570dd3bd44dd3fdf40b1700b515c94e93ce7 Loading...

	www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/cb5c34a81d75be92b85a6e44769a7ea9.js.download	70 kB	2023-03-07	2024-04-16
Pretty URL www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/cb5c34a81d75be92b85a6e44769a7ea9.js.download IP 212.115.111.178 ASN #44709 O.m.c. Computers & Communications Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:24:29 Last Seen2024-04-16 19:41:30 Times Seen40 Hash 5f0c54447b913f94e8e7e8d2b0e15a67 fc5f0abf8f3d0156da905e05892d3c2361715bae ab8d923e60dceb37d3b0327383e0e81a84522dbb961df642d5b4bb62ead7a062 Loading...

	www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/jquery-3.3.1.js.download	87 kB	2023-03-07	2024-04-23
Pretty URL www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/jquery-3.3.1.js.download IP 212.115.111.178 ASN #44709 O.m.c. Computers & Communications Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:02 Last Seen2024-04-23 11:43:00 Times Seen105696 Hash a09e13ee94d51c524b7e2a728c7d4039 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Loading...

	www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/foundation.js.download	178 kB	2023-03-07	2024-04-16
Pretty URL www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/foundation.js.download IP 212.115.111.178 ASN #44709 O.m.c. Computers & Communications Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:24:29 Last Seen2024-04-16 19:41:30 Times Seen25 Hash 9a432ec7247c8595145ee35667feafbf d51b4b2bd55b24bd13e65f84fb83a663f6fb56f4 1ba8ec4721f57f16ecbc5217482bb06262356880d805adbcc6c72bbe6623272d Loading...

	www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/Bootstrap.js.download	53 kB	2023-03-07	2024-04-16
Pretty URL www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/Bootstrap.js.download IP 212.115.111.178 ASN #44709 O.m.c. Computers & Communications Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:24:29 Last Seen2024-04-16 19:41:30 Times Seen28 Hash 1f5b8e04e5f666f5d9f112bd062f01c1 ceb594e32ac7b10c5e73feaf6e206c85d3784445 ecb5cd10a64742b3616a5b9c0cb470127edb286231f57008ee3150bb54251695 Loading...

	www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/enrollment.js.download	44 kB	2023-03-07	2024-04-16
Pretty URL www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/enrollment.js.download IP 212.115.111.178 ASN #44709 O.m.c. Computers & Communications Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:24:29 Last Seen2024-04-16 19:41:30 Times Seen28 Hash 0c24be7aa4f27791bd3b5a4662655829 a7bc4cb0387a269123dffac6a0b81e65e040fbc5 c2fd75f2108f81f0dc5f2165197fb7305085c2983b36062d25afb5da7c4f190b Loading...

	nexus.ensighten.com/mtbank/OE-Dev/serverComponent.php?r=4650.563519136362&ClientID=1512&PageID=https%3A%2F%2Fwww.levuneshama.com%2Fdirmtb%2Fverif.php	60 B	2023-03-07	2023-09-16
Pretty URL nexus.ensighten.com/mtbank/OE-Dev/serverComponent.php?r=4650.563519136362&ClientID=1512&PageID=https%3A%2F%2Fwww.levuneshama.com%2Fdirmtb%2Fverif.php IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:20:03 Last Seen2023-09-16 00:58:37 Times Seen34 Hash dc3d06df7033df417cfbe813fb8ef6a3 2abb698cfd18f5ec6b43db6ecf2c526c4901779a ad68c8c7e80948313b864c7f1f78556234fe7d5fc778337a7bf0db2efd0c7468 Loading...

HTTP Transactions (39)

URL IP Response Size

firefox.settings.services.mozilla.com/v1/

143.204.55.115

200 OK

939 B

URL HTTP/1.1
firefox.settings.services.mozilla.com/v1/
IP
143.204.55.115:0
ASN
#16509 AMAZON-02

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
2d12f67fe57a87e7366b662d153a5582
d7b02d81cc74f24a251d9363e0f4b0a149264ec1
73c273c0b5a2de3cb970b8e8c187999d3b55e760dc7766dab4bb76428d19b551

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Type, Alert, Backoff, Retry-After, Content-Length
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Sun, 25 Sep 2022 21:15:08 GMT
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 bb1da7862c4968b28920b91b324095c0.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: -YNh44P8VhVDw567llCf536slTmJZBgvGAWX1Z18IrnIvLtZh9uwCQ==
Age: 1682

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
09a973de929ab7452edc342c780d3668
3f14f6e0a36f76863c0aea6fb561c266404a7ea3
e82ca5f310e37267fbf792427747e65c2bb35e684d3f629c0aa302f688bc4f80

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E82CA5F310E37267FBF792427747E65C2BB35E684D3F629C0AA302F688BC4F80"
Last-Modified: Fri, 23 Sep 2022 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3472
Expires: Sun, 25 Sep 2022 22:41:02 GMT
Date: Sun, 25 Sep 2022 21:43:10 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain

143.204.55.25

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain
IP
143.204.55.25:0
ASN
#16509 AMAZON-02

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
6113f8408c59aebe188d6af273b90743
7398873bf00f99944eaa77ad3ebc0d43c23dba6b
b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 5348
last-modified: Sat, 10 Sep 2022 18:47:45 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Sun, 25 Sep 2022 04:35:15 GMT
etag: "6113f8408c59aebe188d6af273b90743"
x-cache: Hit from cloudfront
via: 1.1 6480520a5e02f3163410e3134bd77baa.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: f9WZqusvocfaL6FPcrlNZZr-SDdkaOWT0mcaVdioL6fGmovRZYYMEA==
age: 61676
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 21:43:10 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.comodoca.com/

172.64.155.188

200 OK

472 B

URL HTTP/1.1
ocsp.comodoca.com/
IP
172.64.155.188:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
472 B (472 bytes)
Hash
6e92bd06390e4e5cf00902a4bf87dadd
3c0735a6f680ea8200be25ee38396e0baf29da59
6a86729313836748caad69e941245f0d4f7cf624555dc76d9bc14f0053daf0bc

HTTP Headers

POST / HTTP/1.1
Host: ocsp.comodoca.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sun, 25 Sep 2022 21:43:10 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Sat, 24 Sep 2022 03:54:45 GMT
Expires: Sat, 01 Oct 2022 03:54:44 GMT
Etag: "3c0735a6f680ea8200be25ee38396e0baf29da59"
Cache-Control: max-age=453693,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: MISS
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7506ef13f8d41c0a-OSL

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

143.204.55.115

200 OK

329 B

URL HTTP/1.1
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
143.204.55.115:0
ASN
#16509 AMAZON-02

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Sun, 25 Sep 2022 21:04:17 GMT
Cache-Control: max-age=3600, max-age=3600
Expires: Sun, 25 Sep 2022 21:14:42 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 1ca0323262515c9240c58fe69a9ac826.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: fEy1dr3bWT2OP-JB-jwMXXU7sO9j-iKpDhwuNPXdX4oIDGzCHjt2jg==
Age: 2334

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
fd3b36dc2b620b48de491a8d9ba00fc0
be67ba7db5215dcb7c9225876e35a5e0a5005c9e
28205ee62c77b1caad6cc24c1ce98ddb92d26f67d41270f7d5278208a907c62f

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5525
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 21:43:11 GMT
Last-Modified: Sun, 25 Sep 2022 20:11:06 GMT
Server: ECS (ska/F717)
X-Cache: HIT
Content-Length: 471

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/b9ce03ceb3f06b3602497b84c93c31ac.js(1).download

212.115.111.178

200 OK

8.3 kB

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/b9ce03ceb3f06b3602497b84c93c31ac.js(1).download
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type
ASCII text, with very long lines (598)
Size
8.3 kB (8301 bytes)
Hash
46a7c4d6d96105dabc6ee98f102812ce
e8ffb98936c7a1ad75f788f05a4b1639934f5853
4c7e2cc8c50ab082334a9d91a8e42018086791fe8170a050628db9c364467d1a

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/b9ce03ceb3f06b3602497b84c93c31ac.js(1).download HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 21:43:10 GMT
content-length: 8301
last-modified: Fri, 30 Nov 2018 05:15:26 GMT
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-cache-status: EXPIRED
x-server-powered-by: Engintron
accept-ranges: bytes
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/mtb-equalhousinglender.svg

212.115.111.178

200 OK

230 B

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/mtb-equalhousinglender.svg
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with no line terminators
Size
230 B (230 bytes)
Hash
916635d10512ae6a1840614a895dcd38
db175de4c42281bb4d239c57d1b95b8e75c529ec
d58eb2802f72d0c6b1d944a1335e8fb914af44b51fe16097aad994c15b8cfbad

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/mtb-equalhousinglender.svg HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 21:43:10 GMT
content-type: image/svg+xml
content-length: 230
last-modified: Fri, 30 Nov 2018 05:15:26 GMT
expires: Thu, 24 Nov 2022 21:43:10 GMT
cache-control: max-age=5184000
pragma: public
accept-ranges: bytes
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/footer-powered-by-000webhost-white2.webp

212.115.111.178

200 OK

1.7 kB

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/footer-powered-by-000webhost-white2.webp
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type
RIFF (little-endian) data, Web/P image\012- data
Size
1.7 kB (1696 bytes)
Hash
4f8ead9b4116b3a5098cf60e0e4195b3
4a783b5ab6cf8a075d89b16fb67250b5f5ed9a5b
86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/footer-powered-by-000webhost-white2.webp HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 21:43:11 GMT
content-type: image/webp
content-length: 1696
last-modified: Fri, 30 Nov 2018 05:15:26 GMT
expires: Thu, 24 Nov 2022 21:43:11 GMT
cache-control: max-age=5184000
pragma: public
accept-ranges: bytes
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/cb5c34a81d75be92b85a6e44769a7ea9.js(1).download

212.115.111.178

200 OK

70 kB

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/cb5c34a81d75be92b85a6e44769a7ea9.js(1).download
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type
ASCII text, with very long lines (1005)
Size
70 kB (70150 bytes)
Hash
5f0c54447b913f94e8e7e8d2b0e15a67
fc5f0abf8f3d0156da905e05892d3c2361715bae
ab8d923e60dceb37d3b0327383e0e81a84522dbb961df642d5b4bb62ead7a062

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/cb5c34a81d75be92b85a6e44769a7ea9.js(1).download HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 21:43:11 GMT
content-length: 70150
last-modified: Fri, 30 Nov 2018 05:15:26 GMT
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-cache-status: HIT
x-server-powered-by: Engintron
accept-ranges: bytes
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/b9ce03ceb3f06b3602497b84c93c31ac.js(1).download

212.115.111.178

200 OK

8.3 kB

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/b9ce03ceb3f06b3602497b84c93c31ac.js(1).download
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type
ASCII text, with very long lines (598)
Size
8.3 kB (8301 bytes)
Hash
46a7c4d6d96105dabc6ee98f102812ce
e8ffb98936c7a1ad75f788f05a4b1639934f5853
4c7e2cc8c50ab082334a9d91a8e42018086791fe8170a050628db9c364467d1a

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/b9ce03ceb3f06b3602497b84c93c31ac.js(1).download HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 21:43:11 GMT
content-length: 8301
last-modified: Fri, 30 Nov 2018 05:15:26 GMT
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-cache-status: HIT
x-server-powered-by: Engintron
accept-ranges: bytes
X-Firefox-Spdy: h2

push.services.mozilla.com/

34.212.13.96

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
34.212.13.96:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: oRWQvAVesxqf6osRY2lDAw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: ZupVTwRYyGCC/cc7glOxeI9cTCs=

www.levuneshama.com/assets/fonts/mandtbaltoweb-book.woff

212.115.111.178

404 Not Found

315 B

URL HTTP/2
www.levuneshama.com/assets/fonts/mandtbaltoweb-book.woff
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
315 B (315 bytes)
Hash
a34ac19f4afae63adc5d2f7bc970c07f
a82190fc530c265aa40a045c21770d967f4767b8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Detections

Analyzer	Verdict	Alert
fortinet	Malware
quad9	Sinkholed

HTTP Headers

GET /assets/fonts/mandtbaltoweb-book.woff HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/mtb.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 404 Not Found
server: nginx
date: Sun, 25 Sep 2022 21:43:11 GMT
content-type: text/html; charset=iso-8859-1
content-length: 315
vary: Accept-Encoding
X-Firefox-Spdy: h2

www.levuneshama.com/assets/fonts/mandtbaltoweb-medium.woff

212.115.111.178

404 Not Found

315 B

URL HTTP/2
www.levuneshama.com/assets/fonts/mandtbaltoweb-medium.woff
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
315 B (315 bytes)
Hash
a34ac19f4afae63adc5d2f7bc970c07f
a82190fc530c265aa40a045c21770d967f4767b8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Detections

Analyzer	Verdict	Alert
fortinet	Malware
quad9	Sinkholed

HTTP Headers

GET /assets/fonts/mandtbaltoweb-medium.woff HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/mtb.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 404 Not Found
server: nginx
date: Sun, 25 Sep 2022 21:43:11 GMT
content-type: text/html; charset=iso-8859-1
content-length: 315
vary: Accept-Encoding
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/errorMsg.js.download

212.115.111.178

404 Not Found

536 B

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/errorMsg.js.download
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type
data
Size
536 B (536 bytes)
Hash
a8a9c4e7c936c016578a9b4bd4149366
c64486385a142185e511b5103b2bcd2fc0bc9de7
ecb3985d205cb1474c981d6afa34bd40e30a47c4038d75c833eb8b43ef62c42a

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/errorMsg.js.download HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 404 Not Found
server: nginx
date: Sun, 25 Sep 2022 21:43:11 GMT
content-type: text/html; charset=iso-8859-1
vary: Accept-Encoding
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-encoding: gzip
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/b9ce03ceb3f06b3602497b84c93c31ac.js.download

212.115.111.178

200 OK

2.4 kB

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/b9ce03ceb3f06b3602497b84c93c31ac.js.download
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type
data
Size
2.4 kB (2414 bytes)
Hash
1299a669b99d5a30af94150dcf4fc11d
1e27df01619daffc8950519adc1b7482363db282
f788d88aa1022cfd84825bbc7b95d17010d58ffde4cfb9a623d81373af0eb8b3

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/b9ce03ceb3f06b3602497b84c93c31ac.js.download HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 21:43:10 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 30 Nov 2018 05:15:24 GMT
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-cache-status: EXPIRED
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
7038cca95198779d8bb479045eb56652
e9dcf9451e849f4d55b0909b33a51bd0b1a35296
0fc47dba3f2789b7c509a4916b1fe3c7b6b30c6778e5354742256125730310f3

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0FC47DBA3F2789B7C509A4916B1FE3C7B6B30C6778E5354742256125730310F3"
Last-Modified: Fri, 23 Sep 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14937
Expires: Mon, 26 Sep 2022 01:52:09 GMT
Date: Sun, 25 Sep 2022 21:43:12 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
7038cca95198779d8bb479045eb56652
e9dcf9451e849f4d55b0909b33a51bd0b1a35296
0fc47dba3f2789b7c509a4916b1fe3c7b6b30c6778e5354742256125730310f3

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0FC47DBA3F2789B7C509A4916B1FE3C7B6B30C6778E5354742256125730310F3"
Last-Modified: Fri, 23 Sep 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14937
Expires: Mon, 26 Sep 2022 01:52:09 GMT
Date: Sun, 25 Sep 2022 21:43:12 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F16a0ebb5-2746-43ce-9354-d29ae28778f1.jpeg

34.120.237.76

200 OK

7.7 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F16a0ebb5-2746-43ce-9354-d29ae28778f1.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.7 kB (7690 bytes)
Hash
75eb09cb0472d311d2deaf4475a2fb29
9e7b0fd5b7c45213e1808361867a254c8e313a30
c18626d0131533976be196823911d5146042e6bd8028389cb4f17a64ee0ec1e4

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F16a0ebb5-2746-43ce-9354-d29ae28778f1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7690
x-amzn-requestid: e50abd36-e3d6-4177-ad5a-57ef7f743e1b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Yv2HqHJqIAMFe9w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63296a30-7de1ba3633620fed1eb26a04;Sampled=0
x-amzn-remapped-date: Tue, 20 Sep 2022 07:22:24 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: N1964asC-XTl9uXwzmgOj5dqDU1mJPKyDl-ZTqhg6wFcDcZFG5ncNQ==
via: 1.1 4d7fa73f804f1c93f20cfc24c4b1266e.cloudfront.net (CloudFront), 1.1 cd858042f70b416ca05e042acf3908a4.cloudfront.net (CloudFront), 1.1 google
date: Sun, 25 Sep 2022 18:07:29 GMT
age: 12943
etag: "9e7b0fd5b7c45213e1808361867a254c8e313a30"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/errorMsg.js.download

212.115.111.178

404 Not Found

10 kB

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/errorMsg.js.download
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type
data
Size
10 kB (10270 bytes)
Hash
5a86f6dce25e38f21695c359346027df
806f91bd84a17acccd6c55549fec834ce47ee520
7008ca92e1bb38b9dce20e02fb7d8e7099914e45e8df469112c6ce9b8820860d

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/errorMsg.js.download HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 404 Not Found
server: nginx
date: Sun, 25 Sep 2022 21:43:11 GMT
content-type: text/html; charset=iso-8859-1
vary: Accept-Encoding
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-encoding: gzip
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9dee94ac-dbe6-4b7f-9dd3-c44ea2324676.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (11045 bytes)
Hash
406b4c0acf367858e80b4b81b1c7c0e9
388d4896026347ee0beccd8fa658877a1b6ebc9b
80256190ac2b3b322f9fe6226820df47d680a161e56d3ec2f0f597a86afdd738

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9dee94ac-dbe6-4b7f-9dd3-c44ea2324676.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11045
x-amzn-requestid: 9684f1b7-959f-4a8e-8685-d2744493fc43
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y7sQvHzFIAMF-WQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632e2737-08b2bef617bdcb2e332774a2;Sampled=0
x-amzn-remapped-date: Fri, 23 Sep 2022 21:37:59 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 4kYYEo9zW8XnhrXNfIyjAk-OI98-PRdf7OP4GqZyH_u1vSf7NxzG_Q==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 09331f0822fc98eebaf04130a83dbd44.cloudfront.net (CloudFront), 1.1 google
date: Sat, 24 Sep 2022 22:09:10 GMT
age: 84842
etag: "388d4896026347ee0beccd8fa658877a1b6ebc9b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/cb5c34a81d75be92b85a6e44769a7ea9.js(1).download

212.115.111.178

200 OK

29 kB

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/cb5c34a81d75be92b85a6e44769a7ea9.js(1).download
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type
data
Size
29 kB (28998 bytes)
Hash
ac9d338caef2e8ab6298ba3b4e324393
2acee0962a28ee70ca6c16386b64de87714228b2
a5960b5e891deaed6b2285acbe13a85b945baf493bd9d2487129570c9c1e3597

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/cb5c34a81d75be92b85a6e44769a7ea9.js(1).download HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 21:43:10 GMT
content-length: 70150
last-modified: Fri, 30 Nov 2018 05:15:26 GMT
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-cache-status: EXPIRED
x-server-powered-by: Engintron
accept-ranges: bytes
X-Firefox-Spdy: h2

34.120.237.76

200 OK

3.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Febe84af5-cb77-4bce-b050-bb28c67f2536.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
3.9 kB (3936 bytes)
Hash
05cc8199d072ccff34e3c0b2ecd65a09
7eda659464993f2945f2c5f4332f96fec9dc0e4c
4fb425a78b4664385741112795978280166b6331baf461aa4ba9440d0ef3826d

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Febe84af5-cb77-4bce-b050-bb28c67f2536.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 3936
x-amzn-requestid: f0dba0d5-752b-4a36-bedd-56e9dd7b508e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y7shFH_iIAMF28w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632e27a0-260fa8c121160aa44b30bd5a;Sampled=0
x-amzn-remapped-date: Fri, 23 Sep 2022 21:39:44 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: MeKT1js9jdTrLi-76N62F42c_7R6e-nf2vSBs2tH-ntLMO0ZP55huw==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 cd858042f70b416ca05e042acf3908a4.cloudfront.net (CloudFront), 1.1 google
date: Sat, 24 Sep 2022 21:47:34 GMT
age: 86138
etag: "7eda659464993f2945f2c5f4332f96fec9dc0e4c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/cb5c34a81d75be92b85a6e44769a7ea9.js.download

212.115.111.178

200 OK

29 kB

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/cb5c34a81d75be92b85a6e44769a7ea9.js.download
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type
data
Size
29 kB (29337 bytes)
Hash
6e545557a8035222adab859612c04f28
4c1ffe4f554cd8d16bcae852d633327be646674b
757f4eecc5dc514a718fc9995973325569f39771d9cd827b5f32a52c7ca1fb6a

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/cb5c34a81d75be92b85a6e44769a7ea9.js.download HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 21:43:10 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 30 Nov 2018 05:15:24 GMT
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-cache-status: EXPIRED
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/mtb-app.js.download

212.115.111.178

200 OK

0 B

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/mtb-app.js.download
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/mtb-app.js.download HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 21:43:11 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 30 Nov 2018 05:15:26 GMT
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-cache-status: EXPIRED
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/mtb-entrust.svg

212.115.111.178

200 OK

0 B

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/mtb-entrust.svg
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/mtb-entrust.svg HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 21:43:11 GMT
content-type: image/svg+xml
vary: Accept-Encoding
last-modified: Fri, 30 Nov 2018 05:15:26 GMT
expires: Thu, 24 Nov 2022 21:43:11 GMT
cache-control: max-age=5184000
pragma: public
content-encoding: gzip
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/serverComponent.php

212.115.111.178

200 OK

0 B

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/serverComponent.php
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/serverComponent.php HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 21:43:11 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-cache-status: EXPIRED
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/mtb-logo.svg

212.115.111.178

200 OK

0 B

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/mtb-logo.svg
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/mtb-logo.svg HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 21:43:10 GMT
content-type: image/svg+xml
vary: Accept-Encoding
last-modified: Fri, 30 Nov 2018 05:15:26 GMT
expires: Thu, 24 Nov 2022 21:43:10 GMT
cache-control: max-age=5184000
pragma: public
content-encoding: gzip
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/Bootstrap.js.download

212.115.111.178

200 OK

0 B

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/Bootstrap.js.download
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/Bootstrap.js.download HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 21:43:11 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 30 Nov 2018 05:15:26 GMT
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-cache-status: EXPIRED
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/formInputValidations.js.download

212.115.111.178

404 Not Found

0 B

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/formInputValidations.js.download
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/formInputValidations.js.download HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 404 Not Found
server: nginx
date: Sun, 25 Sep 2022 21:43:11 GMT
content-type: text/html; charset=iso-8859-1
vary: Accept-Encoding
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-encoding: gzip
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/verif.php

212.115.111.178

200 OK

0 B

URL HTTP/2
www.levuneshama.com/dirmtb/verif.php
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
openphish	M & T Bank Coporation
fortinet	Malware
quad9	Sinkholed

HTTP Headers

GET /dirmtb/verif.php HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 21:43:10 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-cache-status: EXPIRED
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/mtb.css

212.115.111.178

200 OK

0 B

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/mtb.css
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/mtb.css HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 21:43:10 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Fri, 30 Nov 2018 05:15:26 GMT
expires: Tue, 25 Oct 2022 21:43:10 GMT
cache-control: max-age=2592000
pragma: public
content-encoding: gzip
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/serverComponent(1).php

212.115.111.178

200 OK

0 B

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/serverComponent(1).php
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/serverComponent(1).php HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 21:43:11 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-cache-status: EXPIRED
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2

www.levuneshama.com/favicon.ico

212.115.111.178

404 Not Found

0 B

URL HTTP/2
www.levuneshama.com/favicon.ico
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 404 Not Found
server: nginx
date: Sun, 25 Sep 2022 21:43:11 GMT
content-type: text/html; charset=iso-8859-1
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/enrollment.js.download

212.115.111.178

200 OK

0 B

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/enrollment.js.download
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/enrollment.js.download HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 21:43:11 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 30 Nov 2018 05:15:26 GMT
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-cache-status: EXPIRED
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/jquery-3.3.1.js.download

212.115.111.178

200 OK

0 B

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/jquery-3.3.1.js.download
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/jquery-3.3.1.js.download HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 21:43:11 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 30 Nov 2018 05:15:26 GMT
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-cache-status: EXPIRED
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/foundation.js.download

212.115.111.178

200 OK

0 B

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/foundation.js.download
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/foundation.js.download HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 21:43:11 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 30 Nov 2018 05:15:26 GMT
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-cache-status: EXPIRED
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2

www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/foundation-all.css

212.115.111.178

200 OK

0 B

URL HTTP/2
www.levuneshama.com/dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/foundation-all.css
IP
212.115.111.178:0
ASN
#44709 O.m.c. Computers & Communications Ltd

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /dirmtb/Confirm%20Online%20Details%20-%20Verify%20Account%20_%20M&T%20Bank_files/foundation-all.css HTTP/1.1
Host: www.levuneshama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.levuneshama.com/dirmtb/verif.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 21:43:10 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Fri, 30 Nov 2018 05:15:26 GMT
expires: Tue, 25 Oct 2022 21:43:10 GMT
cache-control: max-age=2592000
pragma: public
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (9)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations