penpen-penpen.com
Open in
urlscan Pro
160.16.52.76
Malicious Activity!
Public Scan
Submission: On March 20 via automatic, source openphish — Scanned from JP
Summary
TLS certificate: Issued by JPRS Domain Validation Authority - G4 on January 16th 2024. Valid for: a year.
This is the only time penpen-penpen.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Land Bank of the Philippines (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 3 | 160.16.52.76 160.16.52.76 | 9370 (SAKURA-B ...) (SAKURA-B SAKURA Internet Inc.) | |
18 | 23.10.10.187 23.10.10.187 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
4 | 2606:4700::68... 2606:4700::6812:14e2 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
26 | 4 |
ASN9370 (SAKURA-B SAKURA Internet Inc., JP)
PTR: tk2-202-10572.vs.sakura.ne.jp
penpen-penpen.com |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-10-10-187.deploy.static.akamaitechnologies.com
www.lbpiaccess.com |
ASN13335 (CLOUDFLARENET, US)
seal.globalsign.com | |
ssif1.globalsign.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
lbpiaccess.com
www.lbpiaccess.com |
1 MB |
4 |
globalsign.com
seal.globalsign.com — Cisco Umbrella Rank: 73250 ssif1.globalsign.com — Cisco Umbrella Rank: 112360 |
6 KB |
3 |
penpen-penpen.com
1 redirects
penpen-penpen.com |
203 KB |
26 | 3 |
Domain | Requested by | |
---|---|---|
18 | www.lbpiaccess.com |
penpen-penpen.com
www.lbpiaccess.com |
3 | penpen-penpen.com |
1 redirects
penpen-penpen.com
|
2 | ssif1.globalsign.com |
seal.globalsign.com
penpen-penpen.com |
2 | seal.globalsign.com |
penpen-penpen.com
|
26 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.landbank.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.penpen-penpen.com JPRS Domain Validation Authority - G4 |
2024-01-16 - 2025-01-31 |
a year | crt.sh |
www.landbank.com R3 |
2024-01-12 - 2024-04-11 |
3 months | crt.sh |
www.globalsign.com GlobalSign Extended Validation CA - SHA256 - G3 |
2023-10-04 - 2024-11-04 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://penpen-penpen.com/storage/525/lbcare/index.php
Frame ID: CA6351F5436770A53E12D0384E729D57
Requests: 26 HTTP requests in this frame
Screenshot
Page Title
LANDBANK iAccess Retail Internet Banking - LoginPage URL History Show full URLs
-
https://penpen-penpen.com/storage/525/lbcare/index.php/
HTTP 301
https://penpen-penpen.com/storage/525/lbcare/index.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: About Us
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://penpen-penpen.com/storage/525/lbcare/index.php/
HTTP 301
https://penpen-penpen.com/storage/525/lbcare/index.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index.php
penpen-penpen.com/storage/525/lbcare/ Redirect Chain
|
10 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
theme.css.xhtml
www.lbpiaccess.com/javax.faces.resource/ |
24 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-awesome.css.xhtml
www.lbpiaccess.com/javax.faces.resource/fa/ |
31 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css.xhtml
www.lbpiaccess.com/javax.faces.resource/ |
9 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
components.css.xhtml
www.lbpiaccess.com/javax.faces.resource/ |
94 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js.xhtml
www.lbpiaccess.com/javax.faces.resource/jquery/ |
86 KB 87 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-plugins.js.xhtml
www.lbpiaccess.com/javax.faces.resource/jquery/ |
261 KB 262 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core.js.xhtml
www.lbpiaccess.com/javax.faces.resource/ |
42 KB 43 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
components.js.xhtml
www.lbpiaccess.com/javax.faces.resource/ |
424 KB 427 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core-min.js.xhtml
www.lbpiaccess.com/javax.faces.resource/cryptojs/ |
3 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aes.js.xhtml
www.lbpiaccess.com/javax.faces.resource/cryptojs/ |
13 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
enc-base64-min.js.xhtml
www.lbpiaccess.com/javax.faces.resource/cryptojs/ |
877 B 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sha256-min.js.xhtml
www.lbpiaccess.com/javax.faces.resource/cryptojs/ |
1 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
clienthash.min.js.xhtml
www.lbpiaccess.com/javax.faces.resource/app/ |
2 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.min.js.xhtml
www.lbpiaccess.com/javax.faces.resource/app/ |
604 B 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
validation.js.xhtml
www.lbpiaccess.com/javax.faces.resource/validation/ |
25 KB 25 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
beanvalidation.js.xhtml
www.lbpiaccess.com/javax.faces.resource/validation/ |
9 KB 10 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lbpiaccess.jpg
www.lbpiaccess.com/resources/images/ |
441 KB 442 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_advisory.jpg
penpen-penpen.com/storage/525/lbcare/ |
191 KB 191 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gs_noscript_125-50_en.gif
seal.globalsign.com/SiteSeal/images/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gmogs_image_125-50_en_dblue.js
seal.globalsign.com/SiteSeal/ |
2 KB 819 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bancnet_logo.png
www.lbpiaccess.com/resources/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
siteSeal.do
ssif1.globalsign.com/SiteSeal/siteSeal/siteSeal/ |
7 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
lato-regular-webfont.woff2.xhtml
www.lbpiaccess.com/javax.faces.resource/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
siteSealImage.do
ssif1.globalsign.com/SiteSeal/siteSeal/siteSeal/ |
128 B 183 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
lato-regular-webfont.woff.xhtml
www.lbpiaccess.com/javax.faces.resource/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.lbpiaccess.com
- URL
- https://www.lbpiaccess.com/javax.faces.resource/fonts/lato-regular-webfont.woff2.xhtml?ln=primefaces-frontoffice
- Domain
- www.lbpiaccess.com
- URL
- https://www.lbpiaccess.com/javax.faces.resource/fonts/lato-regular-webfont.woff.xhtml?ln=primefaces-frontoffice
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Land Bank of the Philippines (Banking)47 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| autosize object| jQBrowser function| PF object| PrimeFaces function| Class object| CryptoJS object| _0x1cf3 function| _0x3104 object| ClientHash object| _0x2094 function| _0x37db object| Login function| ss_js_sealTagStr function| ss_js_seal string| ss_ua undefined| ss_opera boolean| ss_msie boolean| ss_msie4 boolean| ss_ns4 boolean| ss_ns6 undefined| ss_opera6lower undefined| ss_no_dyna_script string| ss_fqdn string| ss_size string| ss_type string| ss_lang string| ss_ver string| ss_service string| ss_protocol string| ss_jspUrl function| ss_open_sub function| ss_sealTagStr function| writeFlashImage function| writeFlash function| writeImage function| ss_seal function| ss_right string| ss_domain string| ss_width string| ss_height string| ss_deter_dn string| ss_imageLocation string| ss_flashLocation object| ss_dimensions string| ss_msg1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
penpen-penpen.com/ | Name: PHPSESSID Value: kbvd0o3sci9u9dieokv3olb59m |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
penpen-penpen.com
seal.globalsign.com
ssif1.globalsign.com
www.lbpiaccess.com
www.lbpiaccess.com
160.16.52.76
23.10.10.187
2606:4700::6812:14e2
002d436d5dd4334f54512ee7484a44ffbcbb9a5047add9890789bd5379df195c
1b6fee1309a8fc86102cadf4df26b09c80303fdcbc2221bb08815fa45d3b272b
1b975a25337a9445c1f797a5057d1da9aa82beb8eb0ab0882ca283bd139af4f0
26ee9fafccc6d785b96eb63fcadaa2cc39678eff6d31b66b973520edd18cbcbc
3bc6502a1cb11feab43da0f3f27ed769b52f6e45c8585df652c2a58d5d8b9190
3db63f44968f2f88cb6e93a7c78ae02b315cc3e515d37a24536fbaf5e1a72ecb
40509d57086c720aa07557e34ae53097bd9cdd44a362da9d523ff00893d49537
4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf
4ddc5eda7fbfd049a90018f53d1d9d031152aac14c110497cda63d5c609d5033
543217779bad7d72145fe9e17624f068f3870bd5bb347e822339ba26f4c8f64a
59877905222848d7432553c370f460f3a238a0e7731cb2044cb6f7173ca55783
64ed9c10235cd4f090c03f3121aeb0b7e34ed058a04d416f460088cffb537b90
6c7d5e851044c65cf9f8e1573525f9fda8ce05e8eed600718165c7a2e890d2f0
7bedd38060b64d53ad5c2ad1e2f330970cc61069f65d3d28a32809d329bfce23
8b9815887457c9b236afb15b41ce7932884dc1595a38a6e2aac6ce504a382012
8c49a11b7b5a7b51d2982ab6d7ff931a7f09ad5fcc319723f26168ea97e610ef
99d02c2df8caf8fa07a68d82e7a63a112635c73f03367665786b056c972e1334
a0a28d71883d6791d7feb6c8ba3ca3fb089994f4cf111a34ed78ae803a638c3b
a513a80811d3deb54d2c058e9eb36cd12b868e4e6ac6a9d7b7ae9a816e608d69
afee7e1cfc21acda9d86ba14539d0f20c276d2df3f7d65a5b04d79fbc6ff3d35
be8f4bcd8479e824813dfb137866a006c536472d0797484e831649d8b502f8f6
ca087c45509b633fcf2970a31573505c49537e91f5a62e2e2901da88be1f472c
d88db257247405b2ef627abb593e4d6c77e2f6105e4aa5407d476cc46072af86
ea45ae10d0e966bd5b1714fe28621dd23fa3769f63bf03ffbed0e66d2a6f1d05