![](/screenshots/741ad9c9-28d8-43c3-8920-d8bc2b65f57b.png)
cardinbox.ru
Open in
urlscan Pro
5.23.50.207
Malicious Activity!
Public Scan
Effective URL: https://cardinbox.ru/lbcare1/
Submission: On February 12 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on January 3rd 2024. Valid for: 3 months.
This is the only time cardinbox.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Land Bank of the Philippines (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:303... 2606:4700:3034::6815:659 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:303... 2606:4700:3037::6815:1fa | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 5.23.50.207 5.23.50.207 | () () | |
18 | 23.36.90.208 23.36.90.208 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
4 | 2606:4700::68... 2606:4700::6812:14e2 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
27 | 5 |
ASN16625 (AKAMAI-AS, US)
PTR: a23-36-90-208.deploy.static.akamaitechnologies.com
www.lbpiaccess.com |
ASN13335 (CLOUDFLARENET, US)
seal.globalsign.com | |
ssif1.globalsign.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
lbpiaccess.com
www.lbpiaccess.com |
1 MB |
4 |
globalsign.com
seal.globalsign.com — Cisco Umbrella Rank: 50899 ssif1.globalsign.com |
6 KB |
2 |
cardinbox.ru
cardinbox.ru |
195 KB |
1 |
profitreturn24.com
profitreturn24.com |
546 B |
1 |
centre.is
1 redirects
centre.is |
911 B |
27 | 5 |
Domain | Requested by | |
---|---|---|
18 | www.lbpiaccess.com |
cardinbox.ru
www.lbpiaccess.com |
2 | ssif1.globalsign.com |
seal.globalsign.com
cardinbox.ru |
2 | seal.globalsign.com |
cardinbox.ru
|
2 | cardinbox.ru |
cardinbox.ru
|
1 | profitreturn24.com | |
1 | centre.is | 1 redirects |
27 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.landbank.com |
www.globalsign.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
profitreturn24.com GTS CA 1P5 |
2023-12-19 - 2024-03-18 |
3 months | crt.sh |
cardinbox.ru R3 |
2024-01-03 - 2024-04-02 |
3 months | crt.sh |
www.landbank.com R3 |
2024-01-12 - 2024-04-11 |
3 months | crt.sh |
www.globalsign.com GlobalSign Extended Validation CA - SHA256 - G3 |
2023-10-04 - 2024-11-04 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://cardinbox.ru/lbcare1/
Frame ID: F6E86D1F3A6E6D65DE872F1890982AA4
Requests: 27 HTTP requests in this frame
Screenshot
![](/screenshots/741ad9c9-28d8-43c3-8920-d8bc2b65f57b.png)
Page Title
LANDBANK iAccess Retail Internet Banking - LoginPage URL History Show full URLs
-
http://centre.is/Landbank
HTTP 301
https://profitreturn24.com/lbcare4/index.php Page URL
- https://cardinbox.ru/lbcare1/ Page URL
Detected technologies
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: About Us
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://centre.is/Landbank
HTTP 301
https://profitreturn24.com/lbcare4/index.php Page URL
- https://cardinbox.ru/lbcare1/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://centre.is/Landbank HTTP 301
- https://profitreturn24.com/lbcare4/index.php
27 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
index.php
profitreturn24.com/lbcare4/ Redirect Chain
|
78 B 546 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
cardinbox.ru/lbcare1/ |
10 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
theme.css.xhtml
www.lbpiaccess.com/javax.faces.resource/ |
24 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-awesome.css.xhtml
www.lbpiaccess.com/javax.faces.resource/fa/ |
31 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css.xhtml
www.lbpiaccess.com/javax.faces.resource/ |
9 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
components.css.xhtml
www.lbpiaccess.com/javax.faces.resource/ |
94 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js.xhtml
www.lbpiaccess.com/javax.faces.resource/jquery/ |
86 KB 87 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-plugins.js.xhtml
www.lbpiaccess.com/javax.faces.resource/jquery/ |
261 KB 262 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core.js.xhtml
www.lbpiaccess.com/javax.faces.resource/ |
42 KB 43 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
components.js.xhtml
www.lbpiaccess.com/javax.faces.resource/ |
424 KB 426 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core-min.js.xhtml
www.lbpiaccess.com/javax.faces.resource/cryptojs/ |
3 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aes.js.xhtml
www.lbpiaccess.com/javax.faces.resource/cryptojs/ |
13 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
enc-base64-min.js.xhtml
www.lbpiaccess.com/javax.faces.resource/cryptojs/ |
877 B 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sha256-min.js.xhtml
www.lbpiaccess.com/javax.faces.resource/cryptojs/ |
1 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
clienthash.min.js.xhtml
www.lbpiaccess.com/javax.faces.resource/app/ |
2 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.min.js.xhtml
www.lbpiaccess.com/javax.faces.resource/app/ |
604 B 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
validation.js.xhtml
www.lbpiaccess.com/javax.faces.resource/validation/ |
25 KB 25 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
beanvalidation.js.xhtml
www.lbpiaccess.com/javax.faces.resource/validation/ |
9 KB 10 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lbpiaccess.jpg
www.lbpiaccess.com/resources/images/ |
441 KB 442 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login_advisory.jpg
cardinbox.ru/lbcare1/ |
191 KB 192 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gs_noscript_125-50_en.gif
seal.globalsign.com/SiteSeal/images/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gmogs_image_125-50_en_dblue.js
seal.globalsign.com/SiteSeal/ |
2 KB 814 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bancnet_logo.png
www.lbpiaccess.com/resources/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
siteSeal.do
ssif1.globalsign.com/SiteSeal/siteSeal/siteSeal/ |
7 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
lato-regular-webfont.woff2.xhtml
www.lbpiaccess.com/javax.faces.resource/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
siteSealImage.do
ssif1.globalsign.com/SiteSeal/siteSeal/siteSeal/ |
128 B 183 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
lato-regular-webfont.woff.xhtml
www.lbpiaccess.com/javax.faces.resource/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.lbpiaccess.com
- URL
- https://www.lbpiaccess.com/javax.faces.resource/fonts/lato-regular-webfont.woff2.xhtml?ln=primefaces-frontoffice
- Domain
- www.lbpiaccess.com
- URL
- https://www.lbpiaccess.com/javax.faces.resource/fonts/lato-regular-webfont.woff.xhtml?ln=primefaces-frontoffice
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Land Bank of the Philippines (Banking)32 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| autosize object| jQBrowser function| PF object| PrimeFaces function| Class object| CryptoJS object| _0x1cf3 function| _0x3104 object| ClientHash object| _0x2094 function| _0x37db object| Login function| ss_js_sealTagStr function| ss_js_seal string| ss_ua undefined| ss_opera boolean| ss_msie boolean| ss_msie4 boolean| ss_ns4 boolean| ss_ns6 undefined| ss_opera6lower undefined| ss_no_dyna_script string| ss_fqdn string| ss_size string| ss_type string| ss_lang string| ss_ver string| ss_service string| ss_protocol string| ss_jspUrl0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cardinbox.ru
centre.is
profitreturn24.com
seal.globalsign.com
ssif1.globalsign.com
www.lbpiaccess.com
www.lbpiaccess.com
23.36.90.208
2606:4700:3034::6815:659
2606:4700:3037::6815:1fa
2606:4700::6812:14e2
5.23.50.207
002d436d5dd4334f54512ee7484a44ffbcbb9a5047add9890789bd5379df195c
1b975a25337a9445c1f797a5057d1da9aa82beb8eb0ab0882ca283bd139af4f0
26ee9fafccc6d785b96eb63fcadaa2cc39678eff6d31b66b973520edd18cbcbc
3bc6502a1cb11feab43da0f3f27ed769b52f6e45c8585df652c2a58d5d8b9190
3db63f44968f2f88cb6e93a7c78ae02b315cc3e515d37a24536fbaf5e1a72ecb
3fc69d283ddd8b823d575a22363e66fe28d7d3a26b301a617d231daae8232c6b
40509d57086c720aa07557e34ae53097bd9cdd44a362da9d523ff00893d49537
4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf
4ddc5eda7fbfd049a90018f53d1d9d031152aac14c110497cda63d5c609d5033
543217779bad7d72145fe9e17624f068f3870bd5bb347e822339ba26f4c8f64a
59877905222848d7432553c370f460f3a238a0e7731cb2044cb6f7173ca55783
64ed9c10235cd4f090c03f3121aeb0b7e34ed058a04d416f460088cffb537b90
6c7d5e851044c65cf9f8e1573525f9fda8ce05e8eed600718165c7a2e890d2f0
7bedd38060b64d53ad5c2ad1e2f330970cc61069f65d3d28a32809d329bfce23
7e1289d584b436bd577598b2b679049d4a898b6fa6e79fec358d1283543889bf
8b9815887457c9b236afb15b41ce7932884dc1595a38a6e2aac6ce504a382012
8c49a11b7b5a7b51d2982ab6d7ff931a7f09ad5fcc319723f26168ea97e610ef
99d02c2df8caf8fa07a68d82e7a63a112635c73f03367665786b056c972e1334
a0a28d71883d6791d7feb6c8ba3ca3fb089994f4cf111a34ed78ae803a638c3b
afee7e1cfc21acda9d86ba14539d0f20c276d2df3f7d65a5b04d79fbc6ff3d35
b33e78cac557d085982dbb3b5031f554271bb473475a90c9db75f71b18affb3f
be8f4bcd8479e824813dfb137866a006c536472d0797484e831649d8b502f8f6
ca087c45509b633fcf2970a31573505c49537e91f5a62e2e2901da88be1f472c
d88db257247405b2ef627abb593e4d6c77e2f6105e4aa5407d476cc46072af86
ea45ae10d0e966bd5b1714fe28621dd23fa3769f63bf03ffbed0e66d2a6f1d05