lplusd.com Open in urlscan Pro
69.195.124.134 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://lplusd.com/lbpiaccess/?start=nobody@email.com
Effective URL:
https://lplusd.com/lbpiaccess/
Submission: On June 26 via automatic, source phishtank (June 26th 2022, 5:16:32 am UTC) — Scanned from DE

Summary HTTP 21 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 21 HTTP transactions. The main IP is 69.195.124.134, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is lplusd.com.
TLS certificate: Issued by R3 on May 24th 2022. Valid for: 3 months.

This is the only time lplusd.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Land Bank of the Philippines (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 22	69.195.124.134 69.195.124.134		46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
21	1

22 69.195.124.134 (United States) 1 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: box934.bluehost.com

lplusd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
22	lplusd.com 1 redirects lplusd.com	948 KB
21	1

	Domain	Requested by
22	lplusd.com	1 redirects lplusd.com
21	1

This site contains links to these domains. Also see Links.

Domain
www.landbank.com
www.lbpiaccess.com

Subject Issuer	Validity	Valid
lplusd.com R3	`2022-05-24` - `2022-08-22`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://lplusd.com/lbpiaccess/
Frame ID: 6DA440AEBDA7F1CC9A8E39A86FCF809F
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

LANDBANK iAccess Retail Internet Banking - Login

Page URL History Show full URLs

https://lplusd.com/lbpiaccess/?start=nobody@email.com HTTP 302
https://lplusd.com/lbpiaccess/ Page URL

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

21
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

947 kB
Transfer

1610 kB
Size

1
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://www.landbank.com/about
Title: About Us

Search URL Search Domain Scan URL

URL: https://www.lbpiaccess.com/login/infolink?i=1
Title: FAQs

Search URL Search Domain Scan URL

URL: https://www.lbpiaccess.com/login/infolink?i=2
Title: Security Policy

Search URL Search Domain Scan URL

URL: https://www.lbpiaccess.com/login/infolink?i=3
Title: Data Privacy Statement

Search URL Search Domain Scan URL

URL: https://www.lbpiaccess.com/login/infolink?i=5
Title: Advisory on ATM Use

Search URL Search Domain Scan URL

URL: https://www.lbpiaccess.com/login/infolink?i=4
Title: iAccess Features

Search URL Search Domain Scan URL

URL: https://www.landbank.com/find-us
Title: Find Us

Search URL Search Domain Scan URL

URL: https://www.lbpiaccess.com/register/enroll
Title: Sign up now!

Search URL Search Domain Scan URL

URL: https://www.lbpiaccess.com/login/infolink?i=6
Title: Terms and Conditions

Search URL Search Domain Scan URL

URL: https://www.lbpiaccess.com/login/infolink?i=7
Title: here

Search URL Search Domain Scan URL

URL: https://www.lbpiaccess.com/unlock
Title: Unlock ID

Search URL Search Domain Scan URL

URL: https://www.lbpiaccess.com/forgotpwd
Title: Forgot Password

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://lplusd.com/lbpiaccess/?start=nobody@email.com HTTP 302
https://lplusd.com/lbpiaccess/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response lplusd.com/lbpiaccess/ Redirect Chain https://lplusd.com/lbpiaccess/?start=nobody@email.com https://lplusd.com/lbpiaccess/	8 KB 3 KB	358ms 358ms	Document text/html	69.195.124.134 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lplusd.com/lbpiaccess/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.195.124.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box934.bluehost.com Software Apache / Resource Hash `a4686938e82db5c596d7c405ed0412895062b07a1ab8376b115e4cc1f9e31e11` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 3044 content-type text/html; charset=UTF-8 date Sun, 26 Jun 2022 05:16:26 GMT expires Thu, 19 Nov 1981 08:52:00 GMT host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== pragma no-cache server Apache vary Accept-Encoding Redirect headers cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 3044 content-type text/html; charset=UTF-8 date Sun, 26 Jun 2022 05:16:25 GMT expires Thu, 19 Nov 1981 08:52:00 GMT host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== location ./ pragma no-cache server Apache vary Accept-Encoding
GET H2	200	theme.css lplusd.com/lbpiaccess/login_files/	22 KB 3 KB	162ms 159ms	Stylesheet text/css	69.195.124.134 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lplusd.com/lbpiaccess/login_files/theme.css Requested by Host: lplusd.com URL: https://lplusd.com/lbpiaccess/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.195.124.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box934.bluehost.com Software Apache / Resource Hash `be5fe6e7f73e241d2332683415cafcaa27e63518585ab172de6bad7827d19921` Request headers accept-language de-DE,de;q=0.9 Referer https://lplusd.com/lbpiaccess/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 26 Jun 2022 05:16:26 GMT content-encoding gzip last-modified Sun, 29 May 2022 09:56:36 GMT server Apache host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== vary Accept-Encoding content-type text/css accept-ranges bytes content-length 3291
GET H2	200	font-awesome.css lplusd.com/lbpiaccess/login_files/	30 KB 7 KB	468ms 466ms	Stylesheet text/css	69.195.124.134 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lplusd.com/lbpiaccess/login_files/font-awesome.css Requested by Host: lplusd.com URL: https://lplusd.com/lbpiaccess/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.195.124.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box934.bluehost.com Software Apache / Resource Hash `aaedb7d9f6ae9603d4a49a15bd9deb4b6328f7232f73e5f2a14e70b21e2aca9f` Request headers accept-language de-DE,de;q=0.9 Referer https://lplusd.com/lbpiaccess/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 26 Jun 2022 05:16:26 GMT content-encoding gzip last-modified Sun, 29 May 2022 09:56:34 GMT server Apache host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== vary Accept-Encoding content-type text/css accept-ranges bytes content-length 7132
GET H2	200	style.css lplusd.com/lbpiaccess/login_files/	9 KB 3 KB	161ms 158ms	Stylesheet text/css	69.195.124.134 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lplusd.com/lbpiaccess/login_files/style.css Requested by Host: lplusd.com URL: https://lplusd.com/lbpiaccess/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.195.124.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box934.bluehost.com Software Apache / Resource Hash `4989ab23da34c76c830e196d860158615473b777d70c86725b1408b37893391a` Request headers accept-language de-DE,de;q=0.9 Referer https://lplusd.com/lbpiaccess/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 26 Jun 2022 05:16:26 GMT content-encoding gzip last-modified Sun, 29 May 2022 09:56:36 GMT server Apache host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== vary Accept-Encoding content-type text/css accept-ranges bytes content-length 2857
GET H2	200	components.css lplusd.com/lbpiaccess/login_files/	91 KB 23 KB	468ms 466ms	Stylesheet text/css	69.195.124.134 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lplusd.com/lbpiaccess/login_files/components.css Requested by Host: lplusd.com URL: https://lplusd.com/lbpiaccess/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.195.124.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box934.bluehost.com Software Apache / Resource Hash `7cc5a43b5df384ee06a8c7b07e202ec604dc9299ccf56785c71a8c57afe16044` Request headers accept-language de-DE,de;q=0.9 Referer https://lplusd.com/lbpiaccess/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 26 Jun 2022 05:16:26 GMT content-encoding gzip last-modified Sun, 29 May 2022 09:56:34 GMT server Apache host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== vary Accept-Encoding content-type text/css accept-ranges bytes
GET H2	200	jquery.js Show response lplusd.com/lbpiaccess/login_files/	85 KB 37 KB	315ms 313ms	Script application/javascript	69.195.124.134 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lplusd.com/lbpiaccess/login_files/jquery.js Requested by Host: lplusd.com URL: https://lplusd.com/lbpiaccess/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.195.124.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box934.bluehost.com Software Apache / Resource Hash `160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef` Request headers accept-language de-DE,de;q=0.9 Referer https://lplusd.com/lbpiaccess/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 26 Jun 2022 05:16:26 GMT content-encoding gzip last-modified Sun, 29 May 2022 09:56:36 GMT server Apache host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== vary Accept-Encoding content-type application/javascript accept-ranges bytes
GET H2	200	jquery-plugins.js Show response lplusd.com/lbpiaccess/login_files/	261 KB 94 KB	468ms 466ms	Script application/javascript	69.195.124.134 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lplusd.com/lbpiaccess/login_files/jquery-plugins.js Requested by Host: lplusd.com URL: https://lplusd.com/lbpiaccess/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.195.124.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box934.bluehost.com Software Apache / Resource Hash `e88293d7fd0c6ade3a72fc0c23a277afdc2491cc5cad653786c7d70db54f510e` Request headers accept-language de-DE,de;q=0.9 Referer https://lplusd.com/lbpiaccess/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 26 Jun 2022 05:16:26 GMT content-encoding gzip last-modified Sun, 29 May 2022 09:56:36 GMT server Apache host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== vary Accept-Encoding content-type application/javascript accept-ranges bytes
GET H2	200	core.js Show response lplusd.com/lbpiaccess/login_files/	37 KB 14 KB	314ms 313ms	Script application/javascript	69.195.124.134 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lplusd.com/lbpiaccess/login_files/core.js Requested by Host: lplusd.com URL: https://lplusd.com/lbpiaccess/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.195.124.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box934.bluehost.com Software Apache / Resource Hash `62199d890704dfcc2e5dd56fe4517b0f406950e7fa6205a6421bb43cf3d2b1d3` Request headers accept-language de-DE,de;q=0.9 Referer https://lplusd.com/lbpiaccess/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 26 Jun 2022 05:16:26 GMT content-encoding gzip last-modified Sun, 29 May 2022 09:56:34 GMT server Apache host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 13907
GET H2	200	components.js Show response lplusd.com/lbpiaccess/login_files/	412 KB 138 KB	468ms 466ms	Script application/javascript	69.195.124.134 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lplusd.com/lbpiaccess/login_files/components.js Requested by Host: lplusd.com URL: https://lplusd.com/lbpiaccess/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.195.124.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box934.bluehost.com Software Apache / Resource Hash `9ed8fc97bc5f91c530d5605a290647ff860330d299ea326d0456af0347d0794f` Request headers accept-language de-DE,de;q=0.9 Referer https://lplusd.com/lbpiaccess/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 26 Jun 2022 05:16:26 GMT content-encoding gzip last-modified Sun, 29 May 2022 09:56:34 GMT server Apache host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== vary Accept-Encoding content-type application/javascript accept-ranges bytes
GET H2	200	core-min.js Show response lplusd.com/lbpiaccess/login_files/	3 KB 1 KB	314ms 312ms	Script application/javascript	69.195.124.134 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lplusd.com/lbpiaccess/login_files/core-min.js Requested by Host: lplusd.com URL: https://lplusd.com/lbpiaccess/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.195.124.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box934.bluehost.com Software Apache / Resource Hash `4ddc5eda7fbfd049a90018f53d1d9d031152aac14c110497cda63d5c609d5033` Request headers accept-language de-DE,de;q=0.9 Referer https://lplusd.com/lbpiaccess/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 26 Jun 2022 05:16:26 GMT content-encoding gzip last-modified Sun, 29 May 2022 09:56:34 GMT server Apache host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 1430
GET H2	200	aes.js Show response lplusd.com/lbpiaccess/login_files/	13 KB 6 KB	164ms 163ms	Script application/javascript	69.195.124.134 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lplusd.com/lbpiaccess/login_files/aes.js Requested by Host: lplusd.com URL: https://lplusd.com/lbpiaccess/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.195.124.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box934.bluehost.com Software Apache / Resource Hash `a0a28d71883d6791d7feb6c8ba3ca3fb089994f4cf111a34ed78ae803a638c3b` Request headers accept-language de-DE,de;q=0.9 Referer https://lplusd.com/lbpiaccess/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 26 Jun 2022 05:16:26 GMT content-encoding gzip last-modified Sun, 29 May 2022 09:56:34 GMT server Apache host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 5614
GET H2	200	enc-base64-min.js Show response lplusd.com/lbpiaccess/login_files/	877 B 608 B	623ms 622ms	Script application/javascript	69.195.124.134 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lplusd.com/lbpiaccess/login_files/enc-base64-min.js Requested by Host: lplusd.com URL: https://lplusd.com/lbpiaccess/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.195.124.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box934.bluehost.com Software Apache / Resource Hash `26ee9fafccc6d785b96eb63fcadaa2cc39678eff6d31b66b973520edd18cbcbc` Request headers accept-language de-DE,de;q=0.9 Referer https://lplusd.com/lbpiaccess/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 26 Jun 2022 05:16:26 GMT content-encoding gzip last-modified Sun, 29 May 2022 09:56:34 GMT server Apache host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 575
GET H2	200	sha256-min.js Show response lplusd.com/lbpiaccess/login_files/	1 KB 936 B	622ms 620ms	Script application/javascript	69.195.124.134 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lplusd.com/lbpiaccess/login_files/sha256-min.js Requested by Host: lplusd.com URL: https://lplusd.com/lbpiaccess/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.195.124.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box934.bluehost.com Software Apache / Resource Hash `be8f4bcd8479e824813dfb137866a006c536472d0797484e831649d8b502f8f6` Request headers accept-language de-DE,de;q=0.9 Referer https://lplusd.com/lbpiaccess/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 26 Jun 2022 05:16:26 GMT content-encoding gzip last-modified Sun, 29 May 2022 09:56:36 GMT server Apache host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 903
GET H2	200	clienthash.min.js Show response lplusd.com/lbpiaccess/login_files/	2 KB 664 B	622ms 621ms	Script application/javascript	69.195.124.134 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lplusd.com/lbpiaccess/login_files/clienthash.min.js Requested by Host: lplusd.com URL: https://lplusd.com/lbpiaccess/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.195.124.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box934.bluehost.com Software Apache / Resource Hash `1b975a25337a9445c1f797a5057d1da9aa82beb8eb0ab0882ca283bd139af4f0` Request headers accept-language de-DE,de;q=0.9 Referer https://lplusd.com/lbpiaccess/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 26 Jun 2022 05:16:26 GMT content-encoding gzip last-modified Sun, 29 May 2022 09:56:34 GMT server Apache host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 631
GET H2	200	login.min.js Show response lplusd.com/lbpiaccess/login_files/	604 B 317 B	621ms 620ms	Script application/javascript	69.195.124.134 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lplusd.com/lbpiaccess/login_files/login.min.js Requested by Host: lplusd.com URL: https://lplusd.com/lbpiaccess/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.195.124.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box934.bluehost.com Software Apache / Resource Hash `d88db257247405b2ef627abb593e4d6c77e2f6105e4aa5407d476cc46072af86` Request headers accept-language de-DE,de;q=0.9 Referer https://lplusd.com/lbpiaccess/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 26 Jun 2022 05:16:26 GMT content-encoding gzip last-modified Sun, 29 May 2022 09:56:36 GMT server Apache host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 284
GET H2	200	validation.js Show response lplusd.com/lbpiaccess/login_files/	25 KB 7 KB	622ms 621ms	Script application/javascript	69.195.124.134 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lplusd.com/lbpiaccess/login_files/validation.js Requested by Host: lplusd.com URL: https://lplusd.com/lbpiaccess/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.195.124.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box934.bluehost.com Software Apache / Resource Hash `e5e32eda0fac62f106805d427b92b13bfda68febc977857b854399a921cdd87f` Request headers accept-language de-DE,de;q=0.9 Referer https://lplusd.com/lbpiaccess/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 26 Jun 2022 05:16:26 GMT content-encoding gzip last-modified Sun, 29 May 2022 09:56:36 GMT server Apache host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 6893
GET H2	200	beanvalidation.js Show response lplusd.com/lbpiaccess/login_files/	6 KB 1 KB	623ms 622ms	Script application/javascript	69.195.124.134 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lplusd.com/lbpiaccess/login_files/beanvalidation.js Requested by Host: lplusd.com URL: https://lplusd.com/lbpiaccess/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.195.124.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box934.bluehost.com Software Apache / Resource Hash `b161e729b507f2a53fca68bfca4cae4d9303b4449ccd48e197d1e070ba42f0b4` Request headers accept-language de-DE,de;q=0.9 Referer https://lplusd.com/lbpiaccess/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 26 Jun 2022 05:16:26 GMT content-encoding gzip last-modified Sun, 29 May 2022 09:56:34 GMT server Apache host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 1358
GET H2	200	lbpiaccess.jpg lplusd.com/lbpiaccess/login_files/	441 KB 444 KB	170ms 170ms	Image image/jpeg	69.195.124.134 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://lplusd.com/lbpiaccess/login_files/lbpiaccess.jpg Requested by Host: lplusd.com URL: https://lplusd.com/lbpiaccess/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.195.124.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box934.bluehost.com Software Apache / Resource Hash `7bedd38060b64d53ad5c2ad1e2f330970cc61069f65d3d28a32809d329bfce23` Request headers accept-language de-DE,de;q=0.9 Referer https://lplusd.com/lbpiaccess/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers accept-ranges bytes last-modified Sun, 29 May 2022 09:56:36 GMT server Apache host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== date Sun, 26 Jun 2022 05:16:27 GMT content-length 451959 content-type image/jpeg
GET H2	200	login_advisory.jpg lplusd.com/lbpiaccess/login_files/	156 KB 157 KB	160ms 160ms	Image image/jpeg	69.195.124.134 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://lplusd.com/lbpiaccess/login_files/login_advisory.jpg Requested by Host: lplusd.com URL: https://lplusd.com/lbpiaccess/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.195.124.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box934.bluehost.com Software Apache / Resource Hash `a2985f52dba4aaa2f229f79d7918d7c3d423a9562a965198a9d20141d83bb06f` Request headers accept-language de-DE,de;q=0.9 Referer https://lplusd.com/lbpiaccess/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers accept-ranges bytes last-modified Sun, 29 May 2022 09:56:36 GMT server Apache host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== date Sun, 26 Jun 2022 05:16:27 GMT content-length 160062 content-type image/jpeg
GET H2	200	siteSealImage.do lplusd.com/lbpiaccess/login_files/	128 B 157 B	162ms 162ms	Image image/gif	69.195.124.134 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://lplusd.com/lbpiaccess/login_files/siteSealImage.do Requested by Host: lplusd.com URL: https://lplusd.com/lbpiaccess/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.195.124.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box934.bluehost.com Software Apache / Resource Hash `6c7d5e851044c65cf9f8e1573525f9fda8ce05e8eed600718165c7a2e890d2f0` Request headers accept-language de-DE,de;q=0.9 Referer https://lplusd.com/lbpiaccess/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers accept-ranges bytes last-modified Sun, 29 May 2022 09:56:36 GMT server Apache host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== date Sun, 26 Jun 2022 05:16:27 GMT content-length 128
GET H2	200	bancnet_logo.png lplusd.com/lbpiaccess/login_files/	5 KB 5 KB	161ms 160ms	Image image/png	69.195.124.134 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://lplusd.com/lbpiaccess/login_files/bancnet_logo.png Requested by Host: lplusd.com URL: https://lplusd.com/lbpiaccess/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.195.124.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box934.bluehost.com Software Apache / Resource Hash `ca087c45509b633fcf2970a31573505c49537e91f5a62e2e2901da88be1f472c` Request headers accept-language de-DE,de;q=0.9 Referer https://lplusd.com/lbpiaccess/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers accept-ranges bytes last-modified Sun, 29 May 2022 09:56:34 GMT server Apache host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== date Sun, 26 Jun 2022 05:16:27 GMT content-length 4926 content-type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Land Bank of the Philippines (Banking)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			lplusd.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 43af17a09cca1b0b6c4376168166bf3e

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lplusd.com
69.195.124.134
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1b975a25337a9445c1f797a5057d1da9aa82beb8eb0ab0882ca283bd139af4f0
26ee9fafccc6d785b96eb63fcadaa2cc39678eff6d31b66b973520edd18cbcbc
4989ab23da34c76c830e196d860158615473b777d70c86725b1408b37893391a
4ddc5eda7fbfd049a90018f53d1d9d031152aac14c110497cda63d5c609d5033
62199d890704dfcc2e5dd56fe4517b0f406950e7fa6205a6421bb43cf3d2b1d3
6c7d5e851044c65cf9f8e1573525f9fda8ce05e8eed600718165c7a2e890d2f0
7bedd38060b64d53ad5c2ad1e2f330970cc61069f65d3d28a32809d329bfce23
7cc5a43b5df384ee06a8c7b07e202ec604dc9299ccf56785c71a8c57afe16044
9ed8fc97bc5f91c530d5605a290647ff860330d299ea326d0456af0347d0794f
a0a28d71883d6791d7feb6c8ba3ca3fb089994f4cf111a34ed78ae803a638c3b
a2985f52dba4aaa2f229f79d7918d7c3d423a9562a965198a9d20141d83bb06f
a4686938e82db5c596d7c405ed0412895062b07a1ab8376b115e4cc1f9e31e11
aaedb7d9f6ae9603d4a49a15bd9deb4b6328f7232f73e5f2a14e70b21e2aca9f
b161e729b507f2a53fca68bfca4cae4d9303b4449ccd48e197d1e070ba42f0b4
be5fe6e7f73e241d2332683415cafcaa27e63518585ab172de6bad7827d19921
be8f4bcd8479e824813dfb137866a006c536472d0797484e831649d8b502f8f6
ca087c45509b633fcf2970a31573505c49537e91f5a62e2e2901da88be1f472c
d88db257247405b2ef627abb593e4d6c77e2f6105e4aa5407d476cc46072af86
e5e32eda0fac62f106805d427b92b13bfda68febc977857b854399a921cdd87f
e88293d7fd0c6ade3a72fc0c23a277afdc2491cc5cad653786c7d70db54f510e

lplusd.com Open in urlscan Pro 69.195.124.134 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

21 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

947 kBTransfer

1610 kBSize

1 Cookies

12 Outgoing links

Page URL History

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

21 JavaScript Global Variables

1 Cookies

Indicators

lplusd.com Open in urlscan Pro
69.195.124.134 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

947 kB
Transfer

1610 kB
Size

1
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!