159.138.44.244 - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 1 domains to perform 3 HTTP transactions. The main IP is 159.138.44.244, located in Hong Kong and belongs to HWCLOUDS-AS-AP HUAWEI CLOUDS, HK. The main domain is 159.138.44.244.

This is the only time 159.138.44.244 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Union Bank of the Philippines (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	159.138.44.244 159.138.44.244	136907 (HWCLOUDS-...) (HWCLOUDS-AS-AP HUAWEI CLOUDS)
2 4	104.108.35.181 104.108.35.181	16625 (AKAMAI-AS) (AKAMAI-AS)
3	2

1 159.138.44.244 (Hong Kong)

ASN136907 (HWCLOUDS-AS-AP HUAWEI CLOUDS, HK)
PTR: ecs-159-138-44-244.compute.hwclouds-dns.com

159.138.44.244	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.108.35.181 (Netherlands) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-108-35-181.deploy.static.akamaitechnologies.com

online.unionbankph.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	unionbankph.com 2 redirects online.unionbankph.com	643 KB
3	1

	Domain	Requested by
4	online.unionbankph.com	2 redirects 159.138.44.244
3	1

This site contains links to these domains. Also see Links.

Domain
online.unionbankph.com

Subject Issuer	Validity	Valid
unionbankph.com GlobalSign Extended Validation CA - SHA256 - G3	`2020-07-07` - `2021-01-06`	6 months	crt.sh

This page contains 1 frames:

Primary Page: http://159.138.44.244/%20/
Frame ID: A965C393ED54DEFE91835CDFD59587A3
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

3
Requests

67 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

2
Countries

1432 kB
Transfer

1431 kB
Size

1
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://online.unionbankph.com/online-banking/forgot
Title: Forgot my User ID or Password |

Search URL Search Domain Scan URL

URL: https://online.unionbankph.com/online-banking/unblock/user
Title: Unblock my profile

Search URL Search Domain Scan URL

URL: https://online.unionbankph.com/signup
Title: Sign Up Now

Search URL Search Domain Scan URL

URL: https://online.unionbankph.com/more/terms
Title: Terms & Conditions

Search URL Search Domain Scan URL

URL: https://online.unionbankph.com/more/contact
Title: Contact Us

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://online.unionbankph.com/online-banking/0197659eaac436e5082dd8b8f0f5edc3.png HTTP 302
https://online.unionbankph.com/online-banking/0197659eaac436e5082dd8b8f0f5edc3.png

Request Chain 1

http://online.unionbankph.com/online-banking/04aa55f8de2e368f5621bbfb4c0c67e2.jpg HTTP 302
https://online.unionbankph.com/online-banking/04aa55f8de2e368f5621bbfb4c0c67e2.jpg

3 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.0 404
Not Found Primary Request Cookie set / Show response
159.138.44.244/%20/ 789 KB
790 KB 655ms
633ms Document
text/html 159.138.44.244
HWCLOUDS-AS-AP HU...

General

Check archive.org

Show headers Download Go to

Full URL: http://159.138.44.244/%20/
Protocol: HTTP/1.0
Server: 159.138.44.244 , Hong Kong, ASN136907 (HWCLOUDS-AS-AP HUAWEI CLOUDS, HK),
Reverse DNS: ecs-159-138-44-244.compute.hwclouds-dns.com
Software: Apache /
Resource Hash: f97e9c91bfd9896fa61fbe28e346ba87db0fe4cfae629398c858320a4834515f

Request headers

Host: 159.138.44.244
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 09 Nov 2020 03:00:46 GMT
Server: Apache
Set-Cookie: PHPSESSID=n9p1odjnlvu4an94sef2oidpqf; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8

GET
H/1.1

200
OK

0197659eaac436e5082dd8b8f0f5edc3.png
online.unionbankph.com/online-banking/
Redirect Chain

http://online.unionbankph.com/online-banking/0197659eaac436e5082dd8b8f0f5edc3.png
https://online.unionbankph.com/online-banking/0197659eaac436e5082dd8b8f0f5edc3.png

4 KB
4 KB

214ms
52ms

Image
image/png

104.108.35.181
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.unionbankph.com/online-banking/0197659eaac436e5082dd8b8f0f5edc3.png

Requested by

Host: 159.138.44.244
URL: http://159.138.44.244/%20/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.108.35.181 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-35-181.deploy.static.akamaitechnologies.com

Software

nginx/1.18.0 /

Resource Hash

46644f655d69d30a39e701d2927ce0969a921c99bb7dd73d8747455c4526b6d6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.facebook.com https://.messenger.com https://www.justpay.to
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: http://159.138.44.244/%20/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors https://*.facebook.com https://*.messenger.com https://www.justpay.to
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 3771
X-XSS-Protection: 1; mode=block
Pragma
Last-Modified: Fri, 23 Oct 2020 14:39:44 GMT
Server: nginx/1.18.0
X-Frame-Options: DENY
Date: Mon, 09 Nov 2020 03:00:51 GMT
Strict-Transport-Security: max-age=16070400
Content-Type: image/png
Cache-Control: max-age=53495
Accept-Ranges: bytes
X-Akamai-Path-Stats: [1:166:8834:-]
Expires: Mon, 09 Nov 2020 17:52:26 GMT

Redirect headers

Location: https://online.unionbankph.com/online-banking/0197659eaac436e5082dd8b8f0f5edc3.png
Date: Mon, 09 Nov 2020 03:00:51 GMT
Server: BigIP
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

04aa55f8de2e368f5621bbfb4c0c67e2.jpg
online.unionbankph.com/online-banking/
Redirect Chain

http://online.unionbankph.com/online-banking/04aa55f8de2e368f5621bbfb4c0c67e2.jpg
https://online.unionbankph.com/online-banking/04aa55f8de2e368f5621bbfb4c0c67e2.jpg

638 KB
638 KB

200ms
56ms

Image
image/jpeg

104.108.35.181
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.unionbankph.com/online-banking/04aa55f8de2e368f5621bbfb4c0c67e2.jpg

Requested by

Host: 159.138.44.244
URL: http://159.138.44.244/%20/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.108.35.181 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-35-181.deploy.static.akamaitechnologies.com

Software

nginx/1.18.0 /

Resource Hash

9373d8061b80839d5fa325c7bebbc5854b0162058d45424cf52c556898b23c59

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.facebook.com https://.messenger.com https://www.justpay.to
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: http://159.138.44.244/%20/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
Content-Security-Policy: frame-ancestors https://*.facebook.com https://*.messenger.com https://www.justpay.to
Strict-Transport-Security: max-age=16070400
X-Content-Type-Options: nosniff
Last-Modified: Sun, 08 Nov 2020 18:39:49 GMT
Server: nginx/1.18.0
Date: Mon, 09 Nov 2020 03:00:51 GMT
X-Frame-Options: DENY
Content-Type: image/jpeg
Cache-Control: max-age=71190
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 653169
X-XSS-Protection: 1; mode=block
Expires: Mon, 09 Nov 2020 22:47:21 GMT

Redirect headers

Location: https://online.unionbankph.com/online-banking/04aa55f8de2e368f5621bbfb4c0c67e2.jpg
Date: Mon, 09 Nov 2020 03:00:51 GMT
Server: BigIP
Connection: keep-alive
Content-Length: 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Union Bank of the Philippines (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			159.138.44.244/	1969-12-31 23:59:59	Name: PHPSESSID Value: n9p1odjnlvu4an94sef2oidpqf

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

online.unionbankph.com
104.108.35.181
159.138.44.244
46644f655d69d30a39e701d2927ce0969a921c99bb7dd73d8747455c4526b6d6
9373d8061b80839d5fa325c7bebbc5854b0162058d45424cf52c556898b23c59
f97e9c91bfd9896fa61fbe28e346ba87db0fe4cfae629398c858320a4834515f

159.138.44.244 Open in urlscan Pro 159.138.44.244 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

3 Requests

67 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

2 Countries

1432 kBTransfer

1431 kBSize

1 Cookies

5 Outgoing links

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

Indicators

159.138.44.244 Open in urlscan Pro
159.138.44.244 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

67 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

2
Countries

1432 kB
Transfer

1431 kB
Size

1
Cookies

3 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!