okeasynet.com - urlscan.io

Summary

This website contacted 2 IPs in 3 countries across 5 domains to perform 4 HTTP transactions. The main IP is 2606:4700:3037::681b:a7df, located in United States and belongs to CLOUDFLARENET, US. The main domain is okeasynet.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 2nd 2020. Valid for: a year.

This is the only time okeasynet.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Union Bank of the Philippines (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	167.89.123.122 167.89.123.122	11377 (SENDGRID) (SENDGRID)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	80.74.157.171 80.74.157.171	21069 (ASN-METAN...) (ASN-METANET Routing/peering issues: noc@metanet.ch)
2	2606:4700:303... 2606:4700:3037::681b:a7df	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.109.80.80 104.109.80.80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2

1 167.89.123.122 (United States) 1 redirects

ASN11377 (SENDGRID, US)
PTR: o16789123x122.outbound-mail.sendgrid.net

u4014220.ct.sendgrid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 80.74.157.171 (Switzerland) 1 redirects

ASN21069 (ASN-METANET Routing/peering issues: noc@metanet.ch, CH)
PTR: ns89.kreativmedia.ch

yokotest.hotwork.ag	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3037::681b:a7df (United States)

ASN13335 (CLOUDFLARENET, US)

okeasynet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.109.80.80 (Netherlands)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a104-109-80-80.deploy.static.akamaitechnologies.com

online.unionbankph.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	unionbankph.com online.unionbankph.com	643 KB
2	okeasynet.com okeasynet.com	100 KB
1	hotwork.ag 1 redirects yokotest.hotwork.ag	263 B
1	linkedin.com 1 redirects www.linkedin.com	2 KB
1	sendgrid.net 1 redirects u4014220.ct.sendgrid.net	252 B
4	5

	Domain	Requested by
2	online.unionbankph.com	okeasynet.com
2	okeasynet.com	okeasynet.com
1	yokotest.hotwork.ag	1 redirects
1	www.linkedin.com	1 redirects
1	u4014220.ct.sendgrid.net	1 redirects
4	5

This site contains links to these domains. Also see Links.

Domain
online.unionbankph.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-02` - `2021-08-02`	a year	crt.sh
unionbankph.com GlobalSign Extended Validation CA - SHA256 - G3	`2020-07-07` - `2021-01-06`	6 months	crt.sh

This page contains 1 frames:

Primary Page: https://okeasynet.com/DATA/e/%20/
Frame ID: 8F40737D03AFB6B4359D0712C1569C3B
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://u4014220.ct.sendgrid.net/ls/click?upn=ZlH7cK89TSDOWMjwUgJVXU4e1xXor0AzYDXR1LhvwMtast-2FYnWWJe7IbXiNPc... HTTP 302
https://www.linkedin.com/slink?code=%67%58Y7%43XX HTTP 301
http://yokotest.hotwork.ag/_fonts/?ubpredirect=1 HTTP 302
https://okeasynet.com/DATA/e/%20/ Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

4
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

2
IPs

3
Countries

743 kB
Transfer

1431 kB
Size

2
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://online.unionbankph.com/online-banking/forgot
Title: Forgot my User ID or Password |

Search URL Search Domain Scan URL

URL: https://online.unionbankph.com/online-banking/unblock/user
Title: Unblock my profile

Search URL Search Domain Scan URL

URL: https://online.unionbankph.com/online-banking/signup
Title: Sign Up Now

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://u4014220.ct.sendgrid.net/ls/click?upn=ZlH7cK89TSDOWMjwUgJVXU4e1xXor0AzYDXR1LhvwMtast-2FYnWWJe7IbXiNPc5W-2FWxGJ8Wh35g4kMnaiub7X1w-3D-3DUdi__1-2F24zpGsK-2FbN8ploAcxgieJq5tdk1DFxZ-2BBWmLThSyD68laYT8f7Opu78KyXYXXhaVupi7eMtkbYR6inIHuNvBR2boocsvCKxWtjpk-2FEacukthtlaWPTohGfuIytnXRQkSDU34qk7iZIj4ei8UzUHXSKUiVhzsk2JyiEG9mj-2BCgdWC9xxK-2BLH4PFpkaYXLLlsnLsn2q1pWnBx-2Bt6OYjrlLTY7OhWtMsJEMZmQbEJCnE-3D HTTP 302
https://www.linkedin.com/slink?code=%67%58Y7%43XX HTTP 301
http://yokotest.hotwork.ag/_fonts/?ubpredirect=1 HTTP 302
https://okeasynet.com/DATA/e/%20/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

404

Primary Request / Show response
okeasynet.com/DATA/e/%20/
Redirect Chain

https://u4014220.ct.sendgrid.net/ls/click?upn=ZlH7cK89TSDOWMjwUgJVXU4e1xXor0AzYDXR1LhvwMtast-2FYnWWJe7IbXiNPc5W-2FWxGJ8Wh35g4kMnaiub7X1w-3D-3DUdi__1-2F24zpGsK-2FbN8ploAcxgieJq5tdk1DFxZ-2BBWmLThSyD6...
https://www.linkedin.com/slink?code=%67%58Y7%43XX
http://yokotest.hotwork.ag/_fonts/?ubpredirect=1
https://okeasynet.com/DATA/e/%20/?

21 KB
6 KB

969ms
946ms

Document
text/html

2606:4700:3037::681b:a7df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://okeasynet.com/DATA/e/%20/?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::681b:a7df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.3.17
Resource Hash: ec75693d1d5c5e83ae8ac6bbdee76b74d170b4cfe7184152ea21157080cf4ca7

Request headers

:method: GET
:authority: okeasynet.com
:scheme: https
:path: /DATA/e/%20/?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Dec 2020 08:59:53 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d742c98f9f9c317a87eb14e7a0c3473b51608541192; expires=Wed, 20-Jan-21 08:59:52 GMT; path=/; domain=.okeasynet.com; HttpOnly; SameSite=Lax PHPSESSID=d245f67dafe840e8bec0b8deafe4066b; path=/
x-powered-by: PHP/7.3.17
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
cf-cache-status: DYNAMIC
cf-request-id: 07261fdb060000c2b8c0ab8000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4zmHrNdG2kK0MjKzMNp6X23iWSqyxZdo18AyqX2GmZbmXH5Nb9hIlI1BSGM13wX8czGDumtcm6F9ObWLJpYHuD3NB190tn0FfMI1obcU5Va8hkvP0yw93Up8"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 605068d80a33c2b8-FRA
content-encoding: br

Redirect headers

Server: nginx
Date: Mon, 21 Dec 2020 08:59:52 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Location: https://okeasynet.com/DATA/e/%20/?#https://online.unionbankph.com/online-banking/login#!/login

GET
H2 200 style.css
okeasynet.com/DATA/e/%20/ 769 KB
94 KB 35ms
35ms Stylesheet
text/css 2606:4700:3037::681b:a7df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://okeasynet.com/DATA/e/%20/style.css
Requested by: Host: okeasynet.com
URL: https://okeasynet.com/DATA/e/%20/?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::681b:a7df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c74c0f9285105415f0cc33ca02f0f965c759c80d1c12a22e0ec23ec6e43881a2

Request headers

Referer: https://okeasynet.com/DATA/e/%20/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Dec 2020 08:59:53 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 21 Dec 2020 07:08:08 GMT
server: cloudflare
age: 145
etag: W/"62b79-c0229-5b6f41ecb3bdc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=SvkoePKIzwO0D5R6Xzyuix%2FecJJSkZJ%2FqZBcv1kvg19rr9%2Bd4Xb%2BMl%2B8w9YgIr4P3Z8aRogqjGX9fXFqeuwdWHtfd4kxyKLQ6Nv%2BIzain60nVE6xWzfHcAGu"}],"group":"cf-nel","max_age":604800}
content-type: text/css
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 605068ddfc7ac2b8-FRA
cf-request-id: 07261fdebd0000c2b8a08c2000000001

GET
H/1.1 200
OK 0197659eaac436e5082dd8b8f0f5edc3.png
online.unionbankph.com/online-banking/ 4 KB
4 KB 224ms
35ms Image
image/png 104.109.80.80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.unionbankph.com/online-banking/0197659eaac436e5082dd8b8f0f5edc3.png

Requested by

Host: okeasynet.com
URL: https://okeasynet.com/DATA/e/%20/?

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.109.80.80 , Netherlands, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a104-109-80-80.deploy.static.akamaitechnologies.com

Software

nginx/1.18.0 /

Resource Hash

46644f655d69d30a39e701d2927ce0969a921c99bb7dd73d8747455c4526b6d6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.facebook.com https://.messenger.com https://www.justpay.to
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://okeasynet.com/DATA/e/%20/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors https://*.facebook.com https://*.messenger.com https://www.justpay.to
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 3771
X-XSS-Protection: 1; mode=block
Pragma
Referrer-Policy: strict-origin-when-cross-origin
Last-Modified: Fri, 18 Dec 2020 13:04:59 GMT
Server: nginx/1.18.0
X-Frame-Options: DENY
Date: Mon, 21 Dec 2020 08:59:54 GMT
Strict-Transport-Security: max-age=16070400
Content-Type: image/png
Cache-Control: max-age=34318
Feature-Policy: camera 'self'
Accept-Ranges: bytes
Expires: Mon, 21 Dec 2020 18:31:52 GMT

GET
H/1.1 200
OK 04aa55f8de2e368f5621bbfb4c0c67e2.jpg
online.unionbankph.com/online-banking/ 638 KB
638 KB 151ms
40ms Image
image/jpeg 104.109.80.80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.unionbankph.com/online-banking/04aa55f8de2e368f5621bbfb4c0c67e2.jpg

Requested by

Host: okeasynet.com
URL: https://okeasynet.com/DATA/e/%20/?

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.109.80.80 , Netherlands, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a104-109-80-80.deploy.static.akamaitechnologies.com

Software

nginx/1.18.0 /

Resource Hash

9373d8061b80839d5fa325c7bebbc5854b0162058d45424cf52c556898b23c59

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.facebook.com https://.messenger.com https://www.justpay.to
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://okeasynet.com/DATA/e/%20/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors https://*.facebook.com https://*.messenger.com https://www.justpay.to
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 653169
X-XSS-Protection: 1; mode=block
Pragma
Referrer-Policy: strict-origin-when-cross-origin
Last-Modified: Fri, 18 Dec 2020 13:20:41 GMT
Server: nginx/1.18.0
X-Frame-Options: DENY
Date: Mon, 21 Dec 2020 08:59:54 GMT
Strict-Transport-Security: max-age=16070400
Content-Type: image/jpeg
Cache-Control: max-age=22689
Feature-Policy: camera 'self'
Accept-Ranges: bytes
Expires: Mon, 21 Dec 2020 15:18:03 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Union Bank of the Philippines (Banking)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			okeasynet.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: d245f67dafe840e8bec0b8deafe4066b
			.okeasynet.com/	1970-01-19 15:32:13	Name: __cfduid Value: d742c98f9f9c317a87eb14e7a0c3473b51608541192

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

okeasynet.com
online.unionbankph.com
u4014220.ct.sendgrid.net
www.linkedin.com
yokotest.hotwork.ag
104.109.80.80
167.89.123.122
2606:4700:3037::681b:a7df
2620:1ec:21::14
80.74.157.171
46644f655d69d30a39e701d2927ce0969a921c99bb7dd73d8747455c4526b6d6
9373d8061b80839d5fa325c7bebbc5854b0162058d45424cf52c556898b23c59
c74c0f9285105415f0cc33ca02f0f965c759c80d1c12a22e0ec23ec6e43881a2
ec75693d1d5c5e83ae8ac6bbdee76b74d170b4cfe7184152ea21157080cf4ca7

okeasynet.com Open in urlscan Pro 2606:4700:3037::681b:a7df Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

40 %IPv6

5 Domains

5 Subdomains

2 IPs

3 Countries

743 kBTransfer

1431 kBSize

2 Cookies

3 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

2 Cookies

Indicators

okeasynet.com Open in urlscan Pro
2606:4700:3037::681b:a7df Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

2
IPs

3
Countries

743 kB
Transfer

1431 kB
Size

2
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!