www.sentian.ai - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 18.194.37.101, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is www.sentian.ai.
TLS certificate: Issued by R3 on April 27th 2023. Valid for: 3 months.

This is the only time www.sentian.ai was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Land Bank of the Philippines (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	18.194.37.101 18.194.37.101	16509 (AMAZON-02) (AMAZON-02)
4	141.193.213.20 141.193.213.20	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
5	2

1 18.194.37.101 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-194-37-101.eu-central-1.compute.amazonaws.com

www.sentian.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 141.193.213.20 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

florencelovekarsner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	florencelovekarsner.com florencelovekarsner.com	226 KB
1	sentian.ai www.sentian.ai	2 KB
5	2

	Domain	Requested by
4	florencelovekarsner.com	www.sentian.ai florencelovekarsner.com
1	www.sentian.ai
5	2

This site contains links to these domains. Also see Links.

Domain
karyamudateknik.com
sportsfit.sg
www.angelguardiannc.org
www.narayneesilks.com
www.eternityhomefinance.com
sisodiafabrication.com
crystalvillagegoa.com
www.ewgroup.com.ph
vanakrealty.com

Subject Issuer	Validity	Valid
sentian.ai R3	`2023-04-27` - `2023-07-26`	3 months	crt.sh
florencelovekarsner.com Cloudflare Inc ECC CA-3	`2022-08-01` - `2023-07-31`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://www.sentian.ai/Land%20Bank%20of%20the%20Philippines.htm
Frame ID: 3729F59E339E2342C01695FDDEDE75C6
Requests: 1 HTTP requests in this frame

Frame: https://florencelovekarsner.com/text-align:right;white-space:nowrap;width:650px;font-size:.8em;font-family:arial,helvetica,sans-serif;margin-left:20px;/Update/
Frame ID: 2E72DAF53FED54071CDF819BDAE3F1AD
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Land Bank of the Philippines

Detected technologies

AMP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<link rel="amphtml"

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

228 kB
Transfer

245 kB
Size

0
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://karyamudateknik.com/land%20bank%21update%23file/land%20bank%21update%23file.html
Title: asiagame99

Search URL Search Domain Scan URL

URL: https://sportsfit.sg/wp-content/uploads/2023/05/position-absolute-left-50-transform-translate-50-50-font-family-HelveticaArialsans-serif-text-transform-uppercase-outline-0-background-65cead-border-0-border-radius-8px-padding-4px-color-ffffff.html
Title: asia99

Search URL Search Domain Scan URL

URL: https://www.angelguardiannc.org/wp-content/uploads/2023/05/land-bank-up-date-file.html
Title: pilar168

Search URL Search Domain Scan URL

URL: https://www.narayneesilks.com/wp-content/uploads/2023/05/land-bankofthePhilippines.html
Title: pilar168

Search URL Search Domain Scan URL

URL: https://www.eternityhomefinance.com/wp-content/uploads/2023/05/land20bank2Aof26the3FPhilippines.html
Title: pilar168

Search URL Search Domain Scan URL

URL: https://sisodiafabrication.com/wp-content/uploads/2023/05/land20bank2Aof26the3FPhilippines.html
Title: asia99

Search URL Search Domain Scan URL

URL: https://crystalvillagegoa.com/wp-content/uploads/land20bank2Aof26the3FPhilippines.html
Title: momo99

Search URL Search Domain Scan URL

URL: https://www.ewgroup.com.ph/wp-content/uploads/land20bank2Aof26the3FPhilippines.html
Title: asia99

Search URL Search Domain Scan URL

URL: https://vanakrealty.com/wp-content/uploads/2023/05/land20bank2Aof26the3FPhilippines.html
Title: asia99

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Land%20Bank%20of%20the%20Philippines.htm Show response www.sentian.ai/	5 KB 2 KB	287ms 85ms	Document text/html	18.194.37.101 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.sentian.ai/Land%20Bank%20of%20the%20Philippines.htm Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.194.37.101 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-194-37-101.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash `ed3869b3df58a0039ef633a39a25f3f0a661e6a7cf6b5961992bd9ee21a42aee` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Encoding gzip Content-Length 1767 Content-Type text/html Date Sun, 21 May 2023 11:54:21 GMT ETag "1298-5fc2dc4152040-gzip" Keep-Alive timeout=5, max=100 Last-Modified Sun, 21 May 2023 05:52:57 GMT Server Apache Vary Accept-Encoding
GET H2	200	/ Show response florencelovekarsner.com/text-align:right;white-space:nowrap;width:650px;font-size:.8em;font-family:arial,helvetica,sans-serif;margin-left:20px;/Update/ Frame 2E72	20 KB 4 KB	354ms 225ms	Document text/html	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://florencelovekarsner.com/text-align:right;white-space:nowrap;width:650px;font-size:.8em;font-family:arial,helvetica,sans-serif;margin-left:20px;/Update/ Requested by Host: www.sentian.ai URL: https://www.sentian.ai/Land%20Bank%20of%20the%20Philippines.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / WP Engine Resource Hash `3e77f21cc28b8d2fa08dd4722179fdf9f721ae683c2ed3664c0a28f649389195` Request headers Referer https://www.sentian.ai/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control max-age=600, must-revalidate cf-cache-status DYNAMIC cf-ray 7cac9fd0cfffd973-HEL content-encoding br content-type text/html; charset=UTF-8 date Sun, 21 May 2023 11:54:22 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server cloudflare vary Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie x-cache HIT: 2 x-cache-group normal x-cacheable SHORT x-orig-cache-control no-store, no-cache, must-revalidate x-powered-by WP Engine
GET H2	200	2.jpg florencelovekarsner.com/text-align:right;white-space:nowrap;width:650px;font-size:.8em;font-family:arial,helvetica,sans-serif;margin-left:20px;/Update/lb_files/img/ Frame 2E72	58 KB 58 KB	86ms 81ms	Image image/jpeg	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://florencelovekarsner.com/text-align:right;white-space:nowrap;width:650px;font-size:.8em;font-family:arial,helvetica,sans-serif;margin-left:20px;/Update/lb_files/img/2.jpg Requested by Host: florencelovekarsner.com URL: https://florencelovekarsner.com/text-align:right;white-space:nowrap;width:650px;font-size:.8em;font-family:arial,helvetica,sans-serif;margin-left:20px;/Update/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `c936c0cf76c536da63fbffe39d58db082d4c4f2bdaad2bf4560a41097cb3b4f0` Request headers accept-language fi-FI,fi;q=0.9 Referer https://florencelovekarsner.com/text-align:right;white-space:nowrap;width:650px;font-size:.8em;font-family:arial,helvetica,sans-serif;margin-left:20px;/Update/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Sun, 21 May 2023 11:54:22 GMT cf-cache-status HIT cf-bgj imgq:100,h2pri last-modified Mon, 08 May 2023 20:20:36 GMT server cloudflare cf-polished origSize=381246, status=webp_bigger etag "64595994-5d13e" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 7cac9fd2bd1ad973-HEL alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 59147
GET H2	200	1.jpg florencelovekarsner.com/text-align:right;white-space:nowrap;width:650px;font-size:.8em;font-family:arial,helvetica,sans-serif;margin-left:20px;/Update/lb_files/img/ Frame 2E72	161 KB 162 KB	107ms 103ms	Image image/jpeg	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://florencelovekarsner.com/text-align:right;white-space:nowrap;width:650px;font-size:.8em;font-family:arial,helvetica,sans-serif;margin-left:20px;/Update/lb_files/img/1.jpg Requested by Host: florencelovekarsner.com URL: https://florencelovekarsner.com/text-align:right;white-space:nowrap;width:650px;font-size:.8em;font-family:arial,helvetica,sans-serif;margin-left:20px;/Update/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `5efd13d1cb0547ddd6f720a587b419b03eefe4e385ee792d8e986a020c62d41e` Request headers accept-language fi-FI,fi;q=0.9 Referer https://florencelovekarsner.com/text-align:right;white-space:nowrap;width:650px;font-size:.8em;font-family:arial,helvetica,sans-serif;margin-left:20px;/Update/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Sun, 21 May 2023 11:54:22 GMT cf-cache-status HIT cf-bgj imgq:100,h2pri last-modified Mon, 08 May 2023 20:20:46 GMT server cloudflare cf-polished origSize=197596, status=webp_bigger etag "6459599e-303dc" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 7cac9fd2bd1bd973-HEL alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 165091
GET H2	200	bancnet.png florencelovekarsner.com/text-align:right;white-space:nowrap;width:650px;font-size:.8em;font-family:arial,helvetica,sans-serif;margin-left:20px;/Update/lb_files/img/ Frame 2E72	2 KB 2 KB	106ms 102ms	Image image/webp	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://florencelovekarsner.com/text-align:right;white-space:nowrap;width:650px;font-size:.8em;font-family:arial,helvetica,sans-serif;margin-left:20px;/Update/lb_files/img/bancnet.png Requested by Host: florencelovekarsner.com URL: https://florencelovekarsner.com/text-align:right;white-space:nowrap;width:650px;font-size:.8em;font-family:arial,helvetica,sans-serif;margin-left:20px;/Update/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `ea2427c420726b9a96cfb35611e56df136e96a4e504a2bfb8a8e2d005e72fa70` Request headers accept-language fi-FI,fi;q=0.9 Referer https://florencelovekarsner.com/text-align:right;white-space:nowrap;width:650px;font-size:.8em;font-family:arial,helvetica,sans-serif;margin-left:20px;/Update/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Sun, 21 May 2023 11:54:22 GMT cf-cache-status HIT cf-polished origFmt=png, origSize=4926 content-disposition inline; filename="bancnet.webp" alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 2072 cf-bgj imgq:100,h2pri last-modified Sat, 01 Apr 2023 18:09:38 GMT server cloudflare etag "64287362-133e" vary Accept content-type image/webp access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 7cac9fd2cd1dd973-HEL

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Land Bank of the Philippines (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://www.sentian.ai/Land%20Bank%20of%20the%20Philippines.htm Message: Error parsing a meta element's content: ';' is not a valid key-value pair separator. Please use ',' instead.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

florencelovekarsner.com
www.sentian.ai
141.193.213.20
18.194.37.101
3e77f21cc28b8d2fa08dd4722179fdf9f721ae683c2ed3664c0a28f649389195
5efd13d1cb0547ddd6f720a587b419b03eefe4e385ee792d8e986a020c62d41e
c936c0cf76c536da63fbffe39d58db082d4c4f2bdaad2bf4560a41097cb3b4f0
ea2427c420726b9a96cfb35611e56df136e96a4e504a2bfb8a8e2d005e72fa70
ed3869b3df58a0039ef633a39a25f3f0a661e6a7cf6b5961992bd9ee21a42aee

www.sentian.ai Open in urlscan Pro 18.194.37.101 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

228 kBTransfer

245 kBSize

0 Cookies

9 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

www.sentian.ai Open in urlscan Pro
18.194.37.101 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

228 kB
Transfer

245 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!