worklog.dev.midis.eu Open in urlscan Pro
217.199.100.106  Malicious Activity! Public Scan

Submitted URL: http://worklog.dev.midis.eu/rbbm.mce/pnnrcc.php
Effective URL: http://worklog.dev.midis.eu/rbbm.mce/signin.php?authorization.oauth2?client_id=K1w4n9Sf5ctb1iv1RFH3QIS8FdvLzQqjSXog6gvbtZnuh...
Submission: On January 28 via manual from ZA — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 217.199.100.106, located in Latvia and belongs to BALTKOM-AS, LV. The main domain is worklog.dev.midis.eu.
This is the only time worklog.dev.midis.eu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Standard Bank (Banking)

Domain & IP information

IP Address AS Autonomous System
7 217.199.100.106 20910 (BALTKOM-AS)
7 1
Apex Domain
Subdomains
Transfer
7 midis.eu
worklog.dev.midis.eu
100 KB
7 1
Domain Requested by
7 worklog.dev.midis.eu worklog.dev.midis.eu
7 1

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://worklog.dev.midis.eu/rbbm.mce/signin.php?authorization.oauth2?client_id=K1w4n9Sf5ctb1iv1RFH3QIS8FdvLzQqjSXog6gvbtZnuhTw8ydcoV5xAi2mSTMcLJA1QQx1jwpONikWR&response_type=code&scope=openid%20profile%20email%20device%20ost.all%20sbg-card.all%20sbg-corecustomerplatform.all%20sbg-forex.all%20sbg-payment.all%20sbg-platform.all%20sbg-systems.all%20urn:pingidentity:directory-api&redirect_uri=https://onlinebanking.standardbank.co.za/auth/prompt=login
Frame ID: C8A4889D43286D4ED40AB0AA219334A5
Requests: 7 HTTP requests in this frame

Screenshot

Page Title

Sign in

Page URL History Show full URLs

  1. http://worklog.dev.midis.eu/rbbm.mce/pnnrcc.php Page URL
  2. http://worklog.dev.midis.eu/rbbm.mce/signin.php?authorization.oauth2?client_id=K1w4n9Sf5ctb1iv1RFH3QIS8F... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

100 kB
Transfer

351 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://worklog.dev.midis.eu/rbbm.mce/pnnrcc.php Page URL
  2. http://worklog.dev.midis.eu/rbbm.mce/signin.php?authorization.oauth2?client_id=K1w4n9Sf5ctb1iv1RFH3QIS8FdvLzQqjSXog6gvbtZnuhTw8ydcoV5xAi2mSTMcLJA1QQx1jwpONikWR&response_type=code&scope=openid%20profile%20email%20device%20ost.all%20sbg-card.all%20sbg-corecustomerplatform.all%20sbg-forex.all%20sbg-payment.all%20sbg-platform.all%20sbg-systems.all%20urn:pingidentity:directory-api&redirect_uri=https://onlinebanking.standardbank.co.za/auth/prompt=login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
pnnrcc.php
worklog.dev.midis.eu/rbbm.mce/
14 KB
2 KB
Document
General
Full URL
http://worklog.dev.midis.eu/rbbm.mce/pnnrcc.php
Protocol
HTTP/1.1
Server
217.199.100.106 , Latvia, ASN20910 (BALTKOM-AS, LV),
Reverse DNS
Software
nginx-rc /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Sat, 28 Jan 2023 20:00:28 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Pragma
no-cache
Server
nginx-rc
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
Primary Request signin.php
worklog.dev.midis.eu/rbbm.mce/
23 KB
4 KB
Document
General
Full URL
http://worklog.dev.midis.eu/rbbm.mce/signin.php?authorization.oauth2?client_id=K1w4n9Sf5ctb1iv1RFH3QIS8FdvLzQqjSXog6gvbtZnuhTw8ydcoV5xAi2mSTMcLJA1QQx1jwpONikWR&response_type=code&scope=openid%20profile%20email%20device%20ost.all%20sbg-card.all%20sbg-corecustomerplatform.all%20sbg-forex.all%20sbg-payment.all%20sbg-platform.all%20sbg-systems.all%20urn:pingidentity:directory-api&redirect_uri=https://onlinebanking.standardbank.co.za/auth/prompt=login
Requested by
Host: worklog.dev.midis.eu
URL: http://worklog.dev.midis.eu/rbbm.mce/pnnrcc.php
Protocol
HTTP/1.1
Server
217.199.100.106 , Latvia, ASN20910 (BALTKOM-AS, LV),
Reverse DNS
Software
nginx-rc /
Resource Hash
fd8933bb20a91fc43d70edd0cfdcaa25d5530e3fbcc944aa5e0972ea31519a80
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://worklog.dev.midis.eu/rbbm.mce/pnnrcc.php
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Sat, 28 Jan 2023 20:00:29 GMT
Server
nginx-rc
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
tea.css
worklog.dev.midis.eu/rbbm.mce/theme/
14 KB
4 KB
Stylesheet
General
Full URL
http://worklog.dev.midis.eu/rbbm.mce/theme/tea.css
Requested by
Host: worklog.dev.midis.eu
URL: http://worklog.dev.midis.eu/rbbm.mce/signin.php?authorization.oauth2?client_id=K1w4n9Sf5ctb1iv1RFH3QIS8FdvLzQqjSXog6gvbtZnuhTw8ydcoV5xAi2mSTMcLJA1QQx1jwpONikWR&response_type=code&scope=openid%20profile%20email%20device%20ost.all%20sbg-card.all%20sbg-corecustomerplatform.all%20sbg-forex.all%20sbg-payment.all%20sbg-platform.all%20sbg-systems.all%20urn:pingidentity:directory-api&redirect_uri=https://onlinebanking.standardbank.co.za/auth/prompt=login
Protocol
HTTP/1.1
Server
217.199.100.106 , Latvia, ASN20910 (BALTKOM-AS, LV),
Reverse DNS
Software
nginx-rc /
Resource Hash
081ac22e84a0e65d7ab21e84192ac118505f2ba258137123a1af83e62cda184f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://worklog.dev.midis.eu/rbbm.mce/signin.php?authorization.oauth2?client_id=K1w4n9Sf5ctb1iv1RFH3QIS8FdvLzQqjSXog6gvbtZnuhTw8ydcoV5xAi2mSTMcLJA1QQx1jwpONikWR&response_type=code&scope=openid%20profile%20email%20device%20ost.all%20sbg-card.all%20sbg-corecustomerplatform.all%20sbg-forex.all%20sbg-payment.all%20sbg-platform.all%20sbg-systems.all%20urn:pingidentity:directory-api&redirect_uri=https://onlinebanking.standardbank.co.za/auth/prompt=login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date
Sat, 28 Jan 2023 20:00:29 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Wed, 18 Jan 2023 13:57:56 GMT
Server
nginx-rc
ETag
W/"63c7fae4-3911"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css
X-Frame-Options
SAMEORIGIN
Cache-Control
max-age=2592000, public
Connection
keep-alive
X-XSS-Protection
1; mode=block
Expires
Mon, 27 Feb 2023 20:00:29 GMT
ionic.bundle.css
worklog.dev.midis.eu/rbbm.mce/theme/
19 KB
4 KB
Stylesheet
General
Full URL
http://worklog.dev.midis.eu/rbbm.mce/theme/ionic.bundle.css
Requested by
Host: worklog.dev.midis.eu
URL: http://worklog.dev.midis.eu/rbbm.mce/signin.php?authorization.oauth2?client_id=K1w4n9Sf5ctb1iv1RFH3QIS8FdvLzQqjSXog6gvbtZnuhTw8ydcoV5xAi2mSTMcLJA1QQx1jwpONikWR&response_type=code&scope=openid%20profile%20email%20device%20ost.all%20sbg-card.all%20sbg-corecustomerplatform.all%20sbg-forex.all%20sbg-payment.all%20sbg-platform.all%20sbg-systems.all%20urn:pingidentity:directory-api&redirect_uri=https://onlinebanking.standardbank.co.za/auth/prompt=login
Protocol
HTTP/1.1
Server
217.199.100.106 , Latvia, ASN20910 (BALTKOM-AS, LV),
Reverse DNS
Software
nginx-rc /
Resource Hash
3789296a3c60f4cfa82fd3c139d1d7ef968a06a4bab871f679562121a5869b44
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://worklog.dev.midis.eu/rbbm.mce/signin.php?authorization.oauth2?client_id=K1w4n9Sf5ctb1iv1RFH3QIS8FdvLzQqjSXog6gvbtZnuhTw8ydcoV5xAi2mSTMcLJA1QQx1jwpONikWR&response_type=code&scope=openid%20profile%20email%20device%20ost.all%20sbg-card.all%20sbg-corecustomerplatform.all%20sbg-forex.all%20sbg-payment.all%20sbg-platform.all%20sbg-systems.all%20urn:pingidentity:directory-api&redirect_uri=https://onlinebanking.standardbank.co.za/auth/prompt=login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date
Sat, 28 Jan 2023 20:00:29 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Wed, 18 Jan 2023 13:57:56 GMT
Server
nginx-rc
ETag
W/"63c7fae4-4a2b"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css
X-Frame-Options
SAMEORIGIN
Cache-Control
max-age=2592000, public
Connection
keep-alive
X-XSS-Protection
1; mode=block
Expires
Mon, 27 Feb 2023 20:00:29 GMT
sbg.css
worklog.dev.midis.eu/rbbm.mce/theme/
25 KB
5 KB
Stylesheet
General
Full URL
http://worklog.dev.midis.eu/rbbm.mce/theme/sbg.css
Requested by
Host: worklog.dev.midis.eu
URL: http://worklog.dev.midis.eu/rbbm.mce/signin.php?authorization.oauth2?client_id=K1w4n9Sf5ctb1iv1RFH3QIS8FdvLzQqjSXog6gvbtZnuhTw8ydcoV5xAi2mSTMcLJA1QQx1jwpONikWR&response_type=code&scope=openid%20profile%20email%20device%20ost.all%20sbg-card.all%20sbg-corecustomerplatform.all%20sbg-forex.all%20sbg-payment.all%20sbg-platform.all%20sbg-systems.all%20urn:pingidentity:directory-api&redirect_uri=https://onlinebanking.standardbank.co.za/auth/prompt=login
Protocol
HTTP/1.1
Server
217.199.100.106 , Latvia, ASN20910 (BALTKOM-AS, LV),
Reverse DNS
Software
nginx-rc /
Resource Hash
2ad56c16942ae8b05ad83d4e7c044b1e7df97846e3ddc3cf9ce9d5ca179b70f0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://worklog.dev.midis.eu/rbbm.mce/signin.php?authorization.oauth2?client_id=K1w4n9Sf5ctb1iv1RFH3QIS8FdvLzQqjSXog6gvbtZnuhTw8ydcoV5xAi2mSTMcLJA1QQx1jwpONikWR&response_type=code&scope=openid%20profile%20email%20device%20ost.all%20sbg-card.all%20sbg-corecustomerplatform.all%20sbg-forex.all%20sbg-payment.all%20sbg-platform.all%20sbg-systems.all%20urn:pingidentity:directory-api&redirect_uri=https://onlinebanking.standardbank.co.za/auth/prompt=login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date
Sat, 28 Jan 2023 20:00:29 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Wed, 18 Jan 2023 13:57:56 GMT
Server
nginx-rc
ETag
W/"63c7fae4-6475"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css
X-Frame-Options
SAMEORIGIN
Cache-Control
max-age=2592000, public
Connection
keep-alive
X-XSS-Protection
1; mode=block
Expires
Mon, 27 Feb 2023 20:00:29 GMT
jquery-2.2.3.js
worklog.dev.midis.eu/rbbm.mce/theme/
253 KB
77 KB
Script
General
Full URL
http://worklog.dev.midis.eu/rbbm.mce/theme/jquery-2.2.3.js
Requested by
Host: worklog.dev.midis.eu
URL: http://worklog.dev.midis.eu/rbbm.mce/signin.php?authorization.oauth2?client_id=K1w4n9Sf5ctb1iv1RFH3QIS8FdvLzQqjSXog6gvbtZnuhTw8ydcoV5xAi2mSTMcLJA1QQx1jwpONikWR&response_type=code&scope=openid%20profile%20email%20device%20ost.all%20sbg-card.all%20sbg-corecustomerplatform.all%20sbg-forex.all%20sbg-payment.all%20sbg-platform.all%20sbg-systems.all%20urn:pingidentity:directory-api&redirect_uri=https://onlinebanking.standardbank.co.za/auth/prompt=login
Protocol
HTTP/1.1
Server
217.199.100.106 , Latvia, ASN20910 (BALTKOM-AS, LV),
Reverse DNS
Software
nginx-rc /
Resource Hash
95a5d6b46c9da70a89f0903e5fdc769a2c266a22a19fcb5598e5448a044db4fe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://worklog.dev.midis.eu/rbbm.mce/signin.php?authorization.oauth2?client_id=K1w4n9Sf5ctb1iv1RFH3QIS8FdvLzQqjSXog6gvbtZnuhTw8ydcoV5xAi2mSTMcLJA1QQx1jwpONikWR&response_type=code&scope=openid%20profile%20email%20device%20ost.all%20sbg-card.all%20sbg-corecustomerplatform.all%20sbg-forex.all%20sbg-payment.all%20sbg-platform.all%20sbg-systems.all%20urn:pingidentity:directory-api&redirect_uri=https://onlinebanking.standardbank.co.za/auth/prompt=login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date
Sat, 28 Jan 2023 20:00:29 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Wed, 18 Jan 2023 13:57:56 GMT
Server
nginx-rc
ETag
W/"63c7fae4-3f258"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/javascript
X-Frame-Options
SAMEORIGIN
Cache-Control
max-age=2592000, public
Connection
keep-alive
X-XSS-Protection
1; mode=block
Expires
Mon, 27 Feb 2023 20:00:29 GMT
sbg.png
worklog.dev.midis.eu/rbbm.mce/theme/
3 KB
4 KB
Image
General
Full URL
http://worklog.dev.midis.eu/rbbm.mce/theme/sbg.png
Requested by
Host: worklog.dev.midis.eu
URL: http://worklog.dev.midis.eu/rbbm.mce/signin.php?authorization.oauth2?client_id=K1w4n9Sf5ctb1iv1RFH3QIS8FdvLzQqjSXog6gvbtZnuhTw8ydcoV5xAi2mSTMcLJA1QQx1jwpONikWR&response_type=code&scope=openid%20profile%20email%20device%20ost.all%20sbg-card.all%20sbg-corecustomerplatform.all%20sbg-forex.all%20sbg-payment.all%20sbg-platform.all%20sbg-systems.all%20urn:pingidentity:directory-api&redirect_uri=https://onlinebanking.standardbank.co.za/auth/prompt=login
Protocol
HTTP/1.1
Server
217.199.100.106 , Latvia, ASN20910 (BALTKOM-AS, LV),
Reverse DNS
Software
nginx-rc /
Resource Hash
1a3aac076d48e18c6bd7547ca190a9b705f78d38cfc61e5a00f391b642c5adab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://worklog.dev.midis.eu/rbbm.mce/signin.php?authorization.oauth2?client_id=K1w4n9Sf5ctb1iv1RFH3QIS8FdvLzQqjSXog6gvbtZnuhTw8ydcoV5xAi2mSTMcLJA1QQx1jwpONikWR&response_type=code&scope=openid%20profile%20email%20device%20ost.all%20sbg-card.all%20sbg-corecustomerplatform.all%20sbg-forex.all%20sbg-payment.all%20sbg-platform.all%20sbg-systems.all%20urn:pingidentity:directory-api&redirect_uri=https://onlinebanking.standardbank.co.za/auth/prompt=login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date
Sat, 28 Jan 2023 20:00:29 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 18 Jan 2023 13:57:56 GMT
Server
nginx-rc
ETag
"63c7fae4-dae"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=2592000, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3502
X-XSS-Protection
1; mode=block
Expires
Mon, 27 Feb 2023 20:00:29 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Standard Bank (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery function| tryit function| check function| showit

1 Cookies

Domain/Path Name / Value
worklog.dev.midis.eu/ Name: PHPSESSID
Value: vt2a9mgbjeqdkf9l4kpel00q55

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block