www.royalweddings.in
Open in
urlscan Pro
192.185.129.4
Malicious Activity!
Public Scan
Effective URL: https://www.royalweddings.in/ilandbankph.com/login/
Submission: On March 30 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on March 19th 2022. Valid for: 3 months.
This is the only time www.royalweddings.in was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Land Bank of the Philippines (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 47.254.94.70 47.254.94.70 | 45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.) | |
1 | 51.124.12.35 51.124.12.35 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
2 | 2a00:1450:400... 2a00:1450:4001:82f::2008 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 104.131.99.102 104.131.99.102 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
5 | 192.185.129.4 192.185.129.4 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
3 | 2a00:1450:400... 2a00:1450:4001:812::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:400c:c00::9d | 15169 (GOOGLE) (GOOGLE) | |
14 | 7 |
ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)
redirectlandbankphlogin.on.drv.tw |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: bh-ht-1.webhostbox.net
www.royalweddings.in |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
royalweddings.in
www.royalweddings.in |
610 KB |
3 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 39 |
20 KB |
2 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 70 |
103 KB |
2 |
drv.tw
redirectlandbankphlogin.on.drv.tw www.drv.tw — Cisco Umbrella Rank: 978624 |
1 KB |
1 |
doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 95 |
452 B |
1 |
abre.ai
1 redirects
abre.ai — Cisco Umbrella Rank: 597952 |
688 B |
14 | 6 |
Domain | Requested by | |
---|---|---|
5 | www.royalweddings.in |
www.royalweddings.in
|
3 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
2 | www.googletagmanager.com |
www.drv.tw
www.googletagmanager.com |
1 | stats.g.doubleclick.net |
www.google-analytics.com
|
1 | abre.ai | 1 redirects |
1 | www.drv.tw |
redirectlandbankphlogin.on.drv.tw
|
1 | redirectlandbankphlogin.on.drv.tw | |
14 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
drv.tw R3 |
2022-03-25 - 2022-06-23 |
3 months | crt.sh |
www.drv.tw GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1 |
2022-01-23 - 2022-07-23 |
6 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2022-03-17 - 2022-06-09 |
3 months | crt.sh |
www.avseng.ecotourismrajasthan.com R3 |
2022-03-19 - 2022-06-17 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2022-03-17 - 2022-06-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.royalweddings.in/ilandbankph.com/login/
Frame ID: 4EEF1800AA5A012B68BAA67FD30C33BF
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
LANDBANK iAccess Retail Internet Banking - LoginPage URL History Show full URLs
- https://redirectlandbankphlogin.on.drv.tw/landbank/?64173908FVZFCTVIFIMaonMpe3 Page URL
-
https://abre.ai/ehEK
HTTP 302
https://www.royalweddings.in/ilandbankph.com/ Page URL
- https://www.royalweddings.in/ilandbankph.com/login/ Page URL
Detected technologies
Google Analytics (Analytics) ExpandDetected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtag/js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://redirectlandbankphlogin.on.drv.tw/landbank/?64173908FVZFCTVIFIMaonMpe3 Page URL
-
https://abre.ai/ehEK
HTTP 302
https://www.royalweddings.in/ilandbankph.com/ Page URL
- https://www.royalweddings.in/ilandbankph.com/login/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 4- https://abre.ai/ehEK HTTP 302
- https://www.royalweddings.in/ilandbankph.com/
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
redirectlandbankphlogin.on.drv.tw/landbank/ |
146 B 417 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wd.js
www.drv.tw/inc/ |
690 B 746 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
98 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
175 KB 64 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.royalweddings.in/ilandbankph.com/ Redirect Chain
|
54 B 149 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/g/ |
0 184 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
49 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
collect
www.google-analytics.com/j/ |
2 B 22 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
1 B 452 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
collect
www.google-analytics.com/g/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
www.royalweddings.in/ilandbankph.com/login/ |
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lbpiaccess.jpg
www.royalweddings.in/ilandbankph.com/login/lb_files/img/ |
441 KB 445 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
professor.jpg
www.royalweddings.in/ilandbankph.com/login/lb_files/img/ |
156 KB 157 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bancnet.png
www.royalweddings.in/ilandbankph.com/login/lb_files/img/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.google-analytics.com
- URL
- https://www.google-analytics.com/g/collect?v=2&tid=G-NBGQJBJMEG>m=2oe3n1&_p=284721644&sr=1600x1200&ul=en-us&cid=898162879.1648639149&dl=https%3A%2F%2Fredirectlandbankphlogin.on.drv.tw%2Flandbank%2F%3F64173908FVZFCTVIFIMaonMpe3&dt=&sid=1648639148&sct=1&seg=0&_s=2
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Land Bank of the Philippines (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
redirectlandbankphlogin.on.drv.tw/ | Name: uid Value: rBEPrmJEPKxPwAopWbEpAg== |
|
.drv.tw/ | Name: _ga Value: GA1.2.898162879.1648639149 |
|
.drv.tw/ | Name: _gid Value: GA1.2.1671702278.1648639149 |
|
.drv.tw/ | Name: _gat_gtag_UA_85417367_1 Value: 1 |
|
.drv.tw/ | Name: _ga_NBGQJBJMEG Value: GS1.1.1648639148.1.0.1648639150.0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
abre.ai
redirectlandbankphlogin.on.drv.tw
stats.g.doubleclick.net
www.drv.tw
www.google-analytics.com
www.googletagmanager.com
www.royalweddings.in
www.google-analytics.com
104.131.99.102
192.185.129.4
2a00:1450:4001:812::200e
2a00:1450:4001:82f::2008
2a00:1450:400c:c00::9d
47.254.94.70
51.124.12.35
12738f574f322ba7373084198498280684716d961c23a47dc8d4ec5c912fc402
43c05a89b7ee065c309b9407ef1aa7de201cba3e644c26d8b01a9cd04ca191cc
4f33b00ff60ba75c03cfd1a1a5d0be37fb7bba6718ef54bf9898a53e1c72f87f
7bedd38060b64d53ad5c2ad1e2f330970cc61069f65d3d28a32809d329bfce23
8e5d045d9c025228bf296f5739bd3678dd09ad04e3b3854d1862a71f00ee5679
a2985f52dba4aaa2f229f79d7918d7c3d423a9562a965198a9d20141d83bb06f
ca087c45509b633fcf2970a31573505c49537e91f5a62e2e2901da88be1f472c