www.gylconcesionescontrol.com
Open in
urlscan Pro
162.213.193.194
Malicious Activity!
Public Scan
Effective URL: https://www.gylconcesionescontrol.com/online/login
Submission: On October 24 via manual from PH — Scanned from DE
Summary
TLS certificate: Issued by R3 on October 3rd 2023. Valid for: 3 months.
This is the only time www.gylconcesionescontrol.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Union Bank of the Philippines (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 104.244.42.133 104.244.42.133 | 13414 (TWITTER) (TWITTER) | |
3 17 | 162.213.193.194 162.213.193.194 | 29802 (HVC-AS) (HVC-AS) | |
1 | 2a00:1450:400... 2a00:1450:4001:813::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6812:acf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a00:1450:400... 2a00:1450:4001:82b::2003 | 15169 (GOOGLE) (GOOGLE) | |
19 | 5 |
ASN29802 (HVC-AS, US)
PTR: host.1controlserver.com
www.gylconcesionescontrol.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
gylconcesionescontrol.com
3 redirects
www.gylconcesionescontrol.com |
1 MB |
2 |
gstatic.com
fonts.gstatic.com |
31 KB |
1 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1183 |
7 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 49 |
1 KB |
1 |
t.co
t.co — Cisco Umbrella Rank: 614 |
557 B |
19 | 5 |
Domain | Requested by | |
---|---|---|
17 | www.gylconcesionescontrol.com |
3 redirects
t.co
www.gylconcesionescontrol.com |
2 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | maxcdn.bootstrapcdn.com |
www.gylconcesionescontrol.com
|
1 | fonts.googleapis.com |
www.gylconcesionescontrol.com
|
1 | t.co | |
19 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1 |
2023-02-05 - 2024-02-05 |
a year | crt.sh |
gylconcesionescontrol.com R3 |
2023-10-03 - 2024-01-01 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-09-28 - 2023-12-21 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-12-30 - 2023-12-30 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-09-28 - 2023-12-21 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.gylconcesionescontrol.com/online/login
Frame ID: 27DD3A797CE14AF450C41C1284E73A39
Requests: 19 HTTP requests in this frame
Screenshot
Page Title
Union Bank of the PhilippinesPage URL History Show full URLs
- https://t.co/t3SZbZ3Q33 Page URL
-
https://www.gylconcesionescontrol.com/online
HTTP 301
https://www.gylconcesionescontrol.com/online/ HTTP 302
https://www.gylconcesionescontrol.com/online/visitor HTTP 302
https://www.gylconcesionescontrol.com/online/login Page URL
Detected technologies
Ant Design (JavaScript Frameworks) ExpandDetected patterns
- <[^>]*class="ant-(?:btn|col|row|layout|breadcrumb|menu|pagination|steps|select|cascader|checkbox|calendar|form|input-number|input|mention|rate|radio|slider|switch|tree-select|time-picker|transfer|upload|avatar|badge|card|carousel|collapse|list|popover|tooltip|table|tabs|tag|timeline|tree|alert|modal|message|notification|progress|popconfirm|spin|anchor|back-top|divider|drawer)
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://t.co/t3SZbZ3Q33 Page URL
-
https://www.gylconcesionescontrol.com/online
HTTP 301
https://www.gylconcesionescontrol.com/online/ HTTP 302
https://www.gylconcesionescontrol.com/online/visitor HTTP 302
https://www.gylconcesionescontrol.com/online/login Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
t3SZbZ3Q33
t.co/ |
287 B 557 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
login
www.gylconcesionescontrol.com/online/ Redirect Chain
|
35 KB 35 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.5b3cd0a02202c16cafe1.css
www.gylconcesionescontrol.com/online/online/ |
3 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bundle.5b3cd0a02202c16cafe1.css
www.gylconcesionescontrol.com/online/online/ |
925 KB 925 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
base.5b3cd0a02202c16cafe1.js
www.gylconcesionescontrol.com/online/online/ |
10 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
4.5b3cd0a02202c16cafe1.js
www.gylconcesionescontrol.com/online/online/ |
10 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
12.5b3cd0a02202c16cafe1.css
www.gylconcesionescontrol.com/online/online/ |
294 B 553 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
12.5b3cd0a02202c16cafe1.js
www.gylconcesionescontrol.com/online/online/ |
10 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
6.5b3cd0a02202c16cafe1.css
www.gylconcesionescontrol.com/online/online/ |
4 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
6.5b3cd0a02202c16cafe1.js
www.gylconcesionescontrol.com/online/online/ |
10 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
26.5b3cd0a02202c16cafe1.js
www.gylconcesionescontrol.com/online/online/ |
11 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0197659eaac436e5082dd8b8f0f5edc3.png
www.gylconcesionescontrol.com/online/online/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
6c52619633aaf102bd2a577e2688fa86.png
www.gylconcesionescontrol.com/online/online/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
7 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
04aa55f8de2e368f5621bbfb4c0c67e2.jpg
www.gylconcesionescontrol.com/online/online/ |
325 KB 326 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
mod_pagespeed_beacon
www.gylconcesionescontrol.com/ |
0 139 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Union Bank of the Philippines (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| pagespeed function| showPassword2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.t.co/ | Name: muc Value: 5a357801-9335-4004-ab74-34f3ccac063c |
|
www.gylconcesionescontrol.com/ | Name: PHPSESSID Value: 82e583d6df3502d589b7a5cfff11f6d7 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=0 |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
maxcdn.bootstrapcdn.com
t.co
www.gylconcesionescontrol.com
104.244.42.133
162.213.193.194
2606:4700::6812:acf
2a00:1450:4001:813::200a
2a00:1450:4001:82b::2003
032cf6c781dfb488e0e19248594759087e8c2d9a18d356b977b8da35a7b20649
1631be89735026f4f6bea7e04e0754d305c33311ad8224666424f08c7ce9cd57
46644f655d69d30a39e701d2927ce0969a921c99bb7dd73d8747455c4526b6d6
654a8124fb8ced71ea10099d00a410c67e469fe3ccf4ada825f3fce38e5d02ff
6d634b49605835b4b32433caa4a1d4e6c8e6e98eaa4f987a372c3aac82a8876b
7803e7d95dc99df02fef9580258db074e0d2dee1d3c40fe461836de4a22ee582
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
a76370f59e96324b6224d322dabad8c75f83dc919ccbea3761965074319ee6d4
b9604d30a8683bad79484fa54b564e8f976b630506f2b9a6d9359c826359a09c
bb8208db9912d23f5e589296fe2453de1f2d2ddd54924a3bf4924a774dc40399
c11f2bd4ffa0858a828903f5639e13f7dd770810fb599a0bd70a701663e15147
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8870e9596ff0d9ba9f0639bef5de4d76765c06a38598a7d49e19e23fa49a06a
f4607ebeedc8711e743713a02ea692064fea64c6f0acf2c4bd129bdc70aced34
f4c84785b26e4afa7e344b59d3f3c7610a594545183ea92f7d87fc943dfd6b94
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
ff2746f58870ea29115010a06010d45f9a584b9798a80c5114a30cc39ab777b1