urlscan.io logo urlscan.io
SecurityTrails logo

kanal9tv.com Open in urlscan Pro
35.214.211.97  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://kanal9tv.com/.quarantine/lbfull/
Submission: On March 23 via manual from NL — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 12 HTTP transactions. The main IP is 35.214.211.97, located in Groningen, Netherlands and belongs to GOOGLE, US. The main domain is kanal9tv.com.
TLS certificate: Issued by R3 on March 18th 2022. Valid for: 3 months.
This is the only time kanal9tv.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Land Bank of the Philippines (Banking)

Domain & IP information

IP Address AS Autonomous System
6 35.214.211.97 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 104.111.240.149 16625 (AKAMAI-AS)
4 50.31.99.167 394303 (BIGSCOOTS)
12 4
Apex Domain
Subdomains		 Transfer
6 kanal9tv.com
kanal9tv.com
452 KB
4 tempsitecloud.com
tempsitecloud.com
6 KB
1 lbpiaccess.com
www.lbpiaccess.com
2 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 251
31 KB
12 4
Domain Requested by
6 kanal9tv.com kanal9tv.com
4 tempsitecloud.com kanal9tv.com
tempsitecloud.com
1 www.lbpiaccess.com kanal9tv.com
1 ajax.googleapis.com kanal9tv.com
12 4

This site contains no links.

Subject Issuer Validity Valid
kanal9tv.com
R3		 2022-03-18 -
2022-06-16		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2022-02-28 -
2022-05-23		 3 months crt.sh
www.landbank.com
R3		 2022-03-13 -
2022-06-11		 3 months crt.sh
*.tempsitecloud.com
R3		 2022-02-16 -
2022-05-17		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://kanal9tv.com/.quarantine/lbfull/
Frame ID: CFC53E00642083F6D520BB10114E8C1B
Requests: 8 HTTP requests in this frame

Frame: https://tempsitecloud.com/
Frame ID: 4764412273034AB4449C2649932059CF
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

LANDBANK iAccess Retail Internet Banking - Login

Detected technologies

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

491 kB
Transfer

557 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
kanal9tv.com/.quarantine/lbfull/ 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://kanal9tv.com/.quarantine/lbfull/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.214.211.97 Groningen, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS
97.211.214.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
d2e3e622e6b482606a6c20c637cf1db2e1a2443f278fa85e418bad88d8659ebc

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
nl-NL,nl;q=0.9

Response headers

server
nginx
date
Wed, 23 Mar 2022 02:13:26 GMT
content-type
text/html
vary
Accept-Encoding Accept-Encoding,User-Agent
last-modified
Tue, 22 Mar 2022 19:57:26 GMT
etag
W/"1987-5dad405a25580"
x-httpd
1
host-header
6b7412fb82ca5edfd0917e3957f05d89
x-proxy-cache
MISS
x-proxy-cache-info
0 NC:000000 UP:
content-encoding
br
style.css
kanal9tv.com/.quarantine/lbfull/ 		1 KB
728 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://kanal9tv.com/.quarantine/lbfull/style.css
Requested by
Host: kanal9tv.com
URL: https://kanal9tv.com/.quarantine/lbfull/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.214.211.97 Groningen, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS
97.211.214.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
d130cc5b6028244c9f461e444926d14d36d45e7a45249b9f6373d2959a7d95ba

Request headers

Accept-Language
nl-NL,nl;q=0.9
Referer
https://kanal9tv.com/.quarantine/lbfull/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 23 Mar 2022 02:13:26 GMT
content-encoding
br
last-modified
Tue, 22 Mar 2022 19:58:44 GMT
server
nginx
etag
W/"623a2a74-56c"
vary
Accept-Encoding
x-proxy-cache-info
DT:1
content-type
text/css
cache-control
max-age=31536000
host-header
8441280b0c35cbc1147f8ba998a563a7
expires
Thu, 23 Mar 2023 02:13:26 GMT
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Requested by
Host: kanal9tv.com
URL: https://kanal9tv.com/.quarantine/lbfull/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
nl-NL,nl;q=0.9
Referer
https://kanal9tv.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Tue, 22 Mar 2022 15:45:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
37680
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31021
x-xss-protection
0
last-modified
Fri, 08 May 2020 07:05:03 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Mar 2023 15:45:26 GMT
lbpiaccess.jpg
kanal9tv.com/.quarantine/lbfull/ 		441 KB
442 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kanal9tv.com/.quarantine/lbfull/lbpiaccess.jpg
Requested by
Host: kanal9tv.com
URL: https://kanal9tv.com/.quarantine/lbfull/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.214.211.97 Groningen, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS
97.211.214.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
7bedd38060b64d53ad5c2ad1e2f330970cc61069f65d3d28a32809d329bfce23

Request headers

Accept-Language
nl-NL,nl;q=0.9
Referer
https://kanal9tv.com/.quarantine/lbfull/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 23 Mar 2022 02:13:26 GMT
last-modified
Tue, 22 Mar 2022 18:06:58 GMT
server
nginx
etag
"623a1042-6e577"
x-proxy-cache-info
DT:1
content-type
image/jpeg
cache-control
max-age=31536000
host-header
8441280b0c35cbc1147f8ba998a563a7
accept-ranges
bytes
content-length
451959
expires
Thu, 23 Mar 2023 02:13:26 GMT
favicon.ico
www.lbpiaccess.com/resources/images/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.lbpiaccess.com/resources/images/favicon.ico
Requested by
Host: kanal9tv.com
URL: https://kanal9tv.com/.quarantine/lbfull/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.240.149 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-240-149.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
06c9ad91cf91e1e3fdb85af3cbec9a90d19ffc103ff4c35e4b0079a3a0b16a73
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
nl-NL,nl;q=0.9
Referer
https://kanal9tv.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Strict-Transport-Security
max-age=15552000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Mon, 28 Feb 2022 11:59:54 GMT
Date
Wed, 23 Mar 2022 02:13:27 GMT
X-Frame-Options
SAMEORIGIN
X-ORACLE-DMS-ECID
6e4261d7-2b31-48fe-bd71-3a061db497ae-000f383d
Content-Type
image/x-icon
X-ORACLE-DMS-RID
0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1150
X-XSS-Protection
1; mode=block
ssl.svg
kanal9tv.com/.quarantine/lbfull/ 		603 B
534 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kanal9tv.com/.quarantine/lbfull/ssl.svg
Requested by
Host: kanal9tv.com
URL: https://kanal9tv.com/.quarantine/lbfull/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.214.211.97 Groningen, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS
97.211.214.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
3b439667b653b07d8eec20a02b2c7cb25e4eb2a91acdbdb61f28f9163237067d

Request headers

Accept-Language
nl-NL,nl;q=0.9
Referer
https://kanal9tv.com/.quarantine/lbfull/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 23 Mar 2022 02:13:26 GMT
content-encoding
br
last-modified
Mon, 21 Mar 2022 04:08:58 GMT
server
nginx
etag
W/"6237fa5a-25b"
vary
Accept-Encoding
x-proxy-cache-info
DT:1
content-type
image/svg+xml
cache-control
max-age=31536000
host-header
8441280b0c35cbc1147f8ba998a563a7
expires
Thu, 23 Mar 2023 02:13:26 GMT
bancnet.png
kanal9tv.com/.quarantine/lbfull/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kanal9tv.com/.quarantine/lbfull/bancnet.png
Requested by
Host: kanal9tv.com
URL: https://kanal9tv.com/.quarantine/lbfull/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.214.211.97 Groningen, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS
97.211.214.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
ca087c45509b633fcf2970a31573505c49537e91f5a62e2e2901da88be1f472c

Request headers

Accept-Language
nl-NL,nl;q=0.9
Referer
https://kanal9tv.com/.quarantine/lbfull/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 23 Mar 2022 02:13:26 GMT
last-modified
Tue, 22 Mar 2022 18:07:12 GMT
server
nginx
etag
"623a1050-133e"
x-proxy-cache-info
DT:1
content-type
image/png
cache-control
max-age=31536000
host-header
8441280b0c35cbc1147f8ba998a563a7
accept-ranges
bytes
content-length
4926
expires
Thu, 23 Mar 2023 02:13:26 GMT
script.js
kanal9tv.com/.quarantine/lbfull/ 		3 KB
970 B 		Script
General
Check archive.org
Download Go to
Full URL
https://kanal9tv.com/.quarantine/lbfull/script.js
Requested by
Host: kanal9tv.com
URL: https://kanal9tv.com/.quarantine/lbfull/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.214.211.97 Groningen, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS
97.211.214.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
ec0c2e4c572b330a9384411c8e97fb4216c8e6a1d45345949ac88222ed2e04f5

Request headers

Accept-Language
nl-NL,nl;q=0.9
Referer
https://kanal9tv.com/.quarantine/lbfull/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 23 Mar 2022 02:13:26 GMT
content-encoding
br
last-modified
Tue, 22 Mar 2022 19:58:38 GMT
server
nginx
etag
W/"623a2a6e-b35"
vary
Accept-Encoding
x-proxy-cache-info
DT:1
content-type
application/javascript
cache-control
max-age=31536000
host-header
8441280b0c35cbc1147f8ba998a563a7
expires
Thu, 23 Mar 2023 02:13:26 GMT
/
tempsitecloud.com/ Frame 4764 		7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tempsitecloud.com/
Requested by
Host: kanal9tv.com
URL: https://kanal9tv.com/.quarantine/lbfull/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
50.31.99.167 , United States, ASN394303 (BIGSCOOTS, US),
Reverse DNS
lois.securedserverspace.com
Software
LiteSpeed / PHP/7.4.28
Resource Hash
5aae6321e2f142f9c71e224dafc97edc5a8e56a6b9b28176d56dac638dc72b65
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
nl-NL,nl;q=0.9
Referer
https://kanal9tv.com/

Response headers

x-powered-by
PHP/7.4.28
content-type
text/html; charset=UTF-8
content-length
2468
content-encoding
br
vary
Accept-Encoding
date
Wed, 23 Mar 2022 02:13:27 GMT
server
LiteSpeed
x-content-type-options
nosniff
x-xss-protection
1; mode=block
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
lbpiaccess.jpg
tempsitecloud.com/lb_files/img/ Frame 4764 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tempsitecloud.com/lb_files/img/lbpiaccess.jpg
Requested by
Host: tempsitecloud.com
URL: https://tempsitecloud.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
50.31.99.167 , United States, ASN394303 (BIGSCOOTS, US),
Reverse DNS
lois.securedserverspace.com
Software
LiteSpeed /
Resource Hash
5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
nl-NL,nl;q=0.9
Referer
https://tempsitecloud.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 23 Mar 2022 02:13:27 GMT
x-content-type-options
nosniff
server
LiteSpeed
content-type
text/html
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
1238
x-xss-protection
1; mode=block
professor.jpg
tempsitecloud.com/lb_files/img/ Frame 4764 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tempsitecloud.com/lb_files/img/professor.jpg
Requested by
Host: tempsitecloud.com
URL: https://tempsitecloud.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
50.31.99.167 , United States, ASN394303 (BIGSCOOTS, US),
Reverse DNS
lois.securedserverspace.com
Software
LiteSpeed /
Resource Hash
5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
nl-NL,nl;q=0.9
Referer
https://tempsitecloud.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 23 Mar 2022 02:13:27 GMT
x-content-type-options
nosniff
server
LiteSpeed
content-type
text/html
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
1238
x-xss-protection
1; mode=block
bancnet.png
tempsitecloud.com/lb_files/img/ Frame 4764 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tempsitecloud.com/lb_files/img/bancnet.png
Requested by
Host: tempsitecloud.com
URL: https://tempsitecloud.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
50.31.99.167 , United States, ASN394303 (BIGSCOOTS, US),
Reverse DNS
lois.securedserverspace.com
Software
LiteSpeed /
Resource Hash
5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
nl-NL,nl;q=0.9
Referer
https://tempsitecloud.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 23 Mar 2022 02:13:27 GMT
x-content-type-options
nosniff
server
LiteSpeed
content-type
text/html
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
1238
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Land Bank of the Philippines (Banking)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| structuredClone object| oncontextlost object| oncontextrestored function| $ function| jQuery object| minimize object| square object| exit object| titleBar object| draggable object| title function| enlarge

0 Cookies

3 Console Messages

Source Level URL
Text
network error URL: https://tempsitecloud.com/lb_files/img/lbpiaccess.jpg
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://tempsitecloud.com/lb_files/img/professor.jpg
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://tempsitecloud.com/lb_files/img/bancnet.png
Message:
Failed to load resource: the server responded with a status of 404 ()