![](/screenshots/8e88c840-a33e-4593-b146-a3611d679dc8.png)
lplusd.com
Open in
urlscan Pro
69.195.124.134
Malicious Activity!
Public Scan
Effective URL: https://lplusd.com/lbpiaccess/
Submission: On June 26 via automatic, source phishtank — Scanned from DE
Summary
TLS certificate: Issued by R3 on May 24th 2022. Valid for: 3 months.
This is the only time lplusd.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Land Bank of the Philippines (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 22 | 69.195.124.134 69.195.124.134 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
21 | 1 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: box934.bluehost.com
lplusd.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
22 |
lplusd.com
1 redirects
lplusd.com |
948 KB |
21 | 1 |
Domain | Requested by | |
---|---|---|
22 | lplusd.com |
1 redirects
lplusd.com
|
21 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.landbank.com |
www.lbpiaccess.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
lplusd.com R3 |
2022-05-24 - 2022-08-22 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://lplusd.com/lbpiaccess/
Frame ID: 6DA440AEBDA7F1CC9A8E39A86FCF809F
Requests: 21 HTTP requests in this frame
Screenshot
![](/screenshots/8e88c840-a33e-4593-b146-a3611d679dc8.png)
Page Title
LANDBANK iAccess Retail Internet Banking - LoginPage URL History Show full URLs
-
https://lplusd.com/lbpiaccess/?start=nobody@email.com
HTTP 302
https://lplusd.com/lbpiaccess/ Page URL
Detected technologies
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
12 Outgoing links
These are links going to different origins than the main page.
Title: About Us
Search URL Search Domain Scan URL
Title: FAQs
Search URL Search Domain Scan URL
Title: Security Policy
Search URL Search Domain Scan URL
Title: Data Privacy Statement
Search URL Search Domain Scan URL
Title: Advisory on ATM Use
Search URL Search Domain Scan URL
Title: iAccess Features
Search URL Search Domain Scan URL
Title: Find Us
Search URL Search Domain Scan URL
Title: Sign up now!
Search URL Search Domain Scan URL
Title: Terms and Conditions
Search URL Search Domain Scan URL
Title: here
Search URL Search Domain Scan URL
Title: Unlock ID
Search URL Search Domain Scan URL
Title: Forgot Password
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://lplusd.com/lbpiaccess/?start=nobody@email.com
HTTP 302
https://lplusd.com/lbpiaccess/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
lplusd.com/lbpiaccess/ Redirect Chain
|
8 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
theme.css
lplusd.com/lbpiaccess/login_files/ |
22 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.css
lplusd.com/lbpiaccess/login_files/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
lplusd.com/lbpiaccess/login_files/ |
9 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
components.css
lplusd.com/lbpiaccess/login_files/ |
91 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
lplusd.com/lbpiaccess/login_files/ |
85 KB 37 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-plugins.js
lplusd.com/lbpiaccess/login_files/ |
261 KB 94 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
core.js
lplusd.com/lbpiaccess/login_files/ |
37 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
components.js
lplusd.com/lbpiaccess/login_files/ |
412 KB 138 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
core-min.js
lplusd.com/lbpiaccess/login_files/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aes.js
lplusd.com/lbpiaccess/login_files/ |
13 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
enc-base64-min.js
lplusd.com/lbpiaccess/login_files/ |
877 B 608 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sha256-min.js
lplusd.com/lbpiaccess/login_files/ |
1 KB 936 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clienthash.min.js
lplusd.com/lbpiaccess/login_files/ |
2 KB 664 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.min.js
lplusd.com/lbpiaccess/login_files/ |
604 B 317 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
validation.js
lplusd.com/lbpiaccess/login_files/ |
25 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
beanvalidation.js
lplusd.com/lbpiaccess/login_files/ |
6 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lbpiaccess.jpg
lplusd.com/lbpiaccess/login_files/ |
441 KB 444 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login_advisory.jpg
lplusd.com/lbpiaccess/login_files/ |
156 KB 157 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
siteSealImage.do
lplusd.com/lbpiaccess/login_files/ |
128 B 157 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bancnet_logo.png
lplusd.com/lbpiaccess/login_files/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Land Bank of the Philippines (Banking)21 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery function| autosize function| PF object| PrimeFaces function| Class object| CryptoJS object| _0x1cf3 function| _0x3104 object| ClientHash object| _0x2094 function| _0x37db object| Login1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
lplusd.com/ | Name: PHPSESSID Value: 43af17a09cca1b0b6c4376168166bf3e |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
lplusd.com
69.195.124.134
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1b975a25337a9445c1f797a5057d1da9aa82beb8eb0ab0882ca283bd139af4f0
26ee9fafccc6d785b96eb63fcadaa2cc39678eff6d31b66b973520edd18cbcbc
4989ab23da34c76c830e196d860158615473b777d70c86725b1408b37893391a
4ddc5eda7fbfd049a90018f53d1d9d031152aac14c110497cda63d5c609d5033
62199d890704dfcc2e5dd56fe4517b0f406950e7fa6205a6421bb43cf3d2b1d3
6c7d5e851044c65cf9f8e1573525f9fda8ce05e8eed600718165c7a2e890d2f0
7bedd38060b64d53ad5c2ad1e2f330970cc61069f65d3d28a32809d329bfce23
7cc5a43b5df384ee06a8c7b07e202ec604dc9299ccf56785c71a8c57afe16044
9ed8fc97bc5f91c530d5605a290647ff860330d299ea326d0456af0347d0794f
a0a28d71883d6791d7feb6c8ba3ca3fb089994f4cf111a34ed78ae803a638c3b
a2985f52dba4aaa2f229f79d7918d7c3d423a9562a965198a9d20141d83bb06f
a4686938e82db5c596d7c405ed0412895062b07a1ab8376b115e4cc1f9e31e11
aaedb7d9f6ae9603d4a49a15bd9deb4b6328f7232f73e5f2a14e70b21e2aca9f
b161e729b507f2a53fca68bfca4cae4d9303b4449ccd48e197d1e070ba42f0b4
be5fe6e7f73e241d2332683415cafcaa27e63518585ab172de6bad7827d19921
be8f4bcd8479e824813dfb137866a006c536472d0797484e831649d8b502f8f6
ca087c45509b633fcf2970a31573505c49537e91f5a62e2e2901da88be1f472c
d88db257247405b2ef627abb593e4d6c77e2f6105e4aa5407d476cc46072af86
e5e32eda0fac62f106805d427b92b13bfda68febc977857b854399a921cdd87f
e88293d7fd0c6ade3a72fc0c23a277afdc2491cc5cad653786c7d70db54f510e