some-block.com
Open in
urlscan Pro
92.119.231.110
Malicious Activity!
Public Scan
URL:
https://some-block.com/?gclid=EAIaIQobChMIx66nvtWY-gIVgmSLCh1jlw-mEAMYASAAEgKcOfD_BwE&id=5&url=https%3A%2F%2Fww...
Submission: On September 16 via api from JP — Scanned from JP
Submission: On September 16 via api from JP — Scanned from JP
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 15 HTTP transactions.
The main IP is 92.119.231.110, located in
Kyiv, Ukraine and
belongs to ARILOT-AS, UA.
The main domain is some-block.com.
TLS certificate: Issued by R3 on September 16th 2022. Valid for: 3 months.
This is the only time some-block.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on September 16th 2022. Valid for: 3 months.
This is the only time some-block.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Land Bank of the Philippines (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 15 | 92.119.231.110 92.119.231.110 | 58066 (ARILOT-AS) (ARILOT-AS) | |
| 15 | 1 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 15 |
some-block.com
some-block.com |
944 KB |
| 15 | 1 |
| Domain | Requested by | |
|---|---|---|
| 15 | some-block.com |
some-block.com
|
| 15 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.landbank.com |
| www.lbpiaccess.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| some-block.com R3 |
2022-09-16 - 2022-12-15 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://some-block.com/?gclid=EAIaIQobChMIx66nvtWY-gIVgmSLCh1jlw-mEAMYASAAEgKcOfD_BwE&id=5&url=https%3A%2F%2Fwww.landbank.com%2F
Frame ID: 8F007EBC830255AB81D542E25369DC86
Requests: 15 HTTP requests in this frame
Screenshot
Page Title
LANDBANK iAccess Retail Internet Banking - LoginDetected technologies
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
7 Outgoing links
These are links going to different origins than the main page.
URL: https://www.landbank.com/about
Title: About Us
Title: About Us
Search URL Search Domain Scan URL
URL: https://www.landbank.com/find-us
Title: Find Us
Title: Find Us
Search URL Search Domain Scan URL
URL: https://www.lbpiaccess.com/register/enroll.xhtml
Title: Sign up now!
Title: Sign up now!
Search URL Search Domain Scan URL
URL: https://www.lbpiaccess.com/login/infolink?i=6
Title: Terms and Conditions
Title: Terms and Conditions
Search URL Search Domain Scan URL
URL: https://www.lbpiaccess.com/login/infolink?i=7
Title: here
Title: here
Search URL Search Domain Scan URL
URL: https://www.lbpiaccess.com/unlock.xhtml
Title: Unlock ID
Title: Unlock ID
Search URL Search Domain Scan URL
URL: https://www.lbpiaccess.com/forgotpwd.xhtml
Title: Forgot Password
Title: Forgot Password
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
some-block.com/ |
119 KB 61 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
tag.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
some-block.com/LANDBANK%20iAccess%20Retail%20Internet%20Banking%20-%20Login_files/ |
205 KB 81 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
theme.css
some-block.com/LANDBANK%20iAccess%20Retail%20Internet%20Banking%20-%20Login_files/ |
24 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
font-awesome.css
some-block.com/LANDBANK%20iAccess%20Retail%20Internet%20Banking%20-%20Login_files/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
style.css
some-block.com/LANDBANK%20iAccess%20Retail%20Internet%20Banking%20-%20Login_files/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
components.css
some-block.com/LANDBANK%20iAccess%20Retail%20Internet%20Banking%20-%20Login_files/ |
116 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
load.svg
some-block.com/LANDBANK%20iAccess%20Retail%20Internet%20Banking%20-%20Login_files/ |
497 B 830 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
lbpiaccess.jpg
some-block.com/ |
441 KB 442 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login_advisory.jpg_pfdrid_c=true
some-block.com/LANDBANK%20iAccess%20Retail%20Internet%20Banking%20-%20Login_files/ |
323 KB 324 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
siteSeal.do
some-block.com/LANDBANK_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
siteSealImage.do
some-block.com/LANDBANK_files/ |
229 B 229 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
gmogs_image_125-50_en_dblue.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
some-block.com/LANDBANK_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bancnet_logo.png
some-block.com/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
lato-regular-webfont.woff2.xhtml%3Fln=primefaces-frontoffice
some-block.com/LANDBANK%20iAccess%20Retail%20Internet%20Banking%20-%20Login_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
lato-regular-webfont.woff.xhtml%3Fln=primefaces-frontoffice
some-block.com/LANDBANK%20iAccess%20Retail%20Internet%20Banking%20-%20Login_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Land Bank of the Philippines (Banking)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| Ya0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
some-block.com
92.119.231.110
4325463d5c17aebbc147fb20c300203304a6d06cbe4d8bfbff402ef6a9a5c8cc
48ddcb3978f9fb030436fa1ac7428616d67b987ddd42200d695795a3d64f9bda
4c16dde8d1693a0dbf99e65b14f2f46c07185d175a4452ed530cbc06490be95d
7bedd38060b64d53ad5c2ad1e2f330970cc61069f65d3d28a32809d329bfce23
8618d58131c908ac01c007a362a6b9a270a09bfee0c93f8cfcc44fcea6d2e382
9357b9fec8715a4394299f21ac2a1ad4f2dfc7e09c920a4c07346e48a0e826df
a53860af9d2cacd37da468d99659572f9a84c9b9992e24fdd0bb167578b61c65
a70771861a0f2719f783ba89428a7c82633639d454d4a7052cf675ba6bfb7847
a9475d440f8c4bd9fc0e3f933d8d7fb92e11ca511282b8ed75e37de27f09f3c8
ca087c45509b633fcf2970a31573505c49537e91f5a62e2e2901da88be1f472c
feb280592747c7522788dc142668e74fc20a5a05ecb9607b797297d8bcff52ae