loginapp-updatededonline.systemlinkeds.workers.dev Open in urlscan Pro
2606:4700:3032::ac43:ad7b Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://shot.vin/BdoApp_Verify
Effective URL:
https://loginapp-updatededonline.systemlinkeds.workers.dev/sso/login/wicket:interface/eedyr/:0:loginUnifiedPanel:loginForm::IFormSubmitListener::
Submission Tags: @phish_report
Submission: On January 28 via api (January 28th 2024, 2:52:45 am UTC) from FI — Scanned from NL

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3032::ac43:ad7b, located in United States and belongs to CLOUDFLARENET, US. The main domain is loginapp-updatededonline.systemlinkeds.workers.dev.
TLS certificate: Issued by GTS CA 1P5 on January 27th 2024. Valid for: 3 months.

This is the only time loginapp-updatededonline.systemlinkeds.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BDO Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 7	2606:4700:303... 2606:4700:3032::ac43:ad7b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	23.37.34.2 23.37.34.2	16625 (AKAMAI-AS) (AKAMAI-AS)
13	2

1 2a06:98c1:3121::3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

shot.vin	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700:3032::ac43:ad7b (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

loginapp-updatededonline.systemlinkeds.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 23.37.34.2 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-34-2.deploy.static.akamaitechnologies.com

online.bdo.com.ph	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	bdo.com.ph online.bdo.com.ph — Cisco Umbrella Rank: 333012	123 KB
7	workers.dev 1 redirects loginapp-updatededonline.systemlinkeds.workers.dev	33 KB
1	shot.vin 1 redirects shot.vin	934 B
13	3

	Domain	Requested by
7	online.bdo.com.ph	loginapp-updatededonline.systemlinkeds.workers.dev
7	loginapp-updatededonline.systemlinkeds.workers.dev	1 redirects loginapp-updatededonline.systemlinkeds.workers.dev
1	shot.vin	1 redirects
13	3

This site contains no links.

Subject Issuer	Validity	Valid
systemlinkeds.workers.dev GTS CA 1P5	`2024-01-27` - `2024-04-26`	3 months	crt.sh
www.bdo.com.ph DigiCert SHA2 Extended Validation Server CA	`2024-01-16` - `2024-02-07`	23 days	crt.sh

This page contains 1 frames:

Primary Page: https://loginapp-updatededonline.systemlinkeds.workers.dev/sso/login/wicket:interface/eedyr/:0:loginUnifiedPanel:loginForm::IFormSubmitListener::
Frame ID: 0754C07211AD12F93920DB821F5EE427
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Banco De Oro

Page URL History Show full URLs

http://shot.vin/BdoApp_Verify HTTP 301
https://loginapp-updatededonline.systemlinkeds.workers.dev/redirect HTTP 302
https://loginapp-updatededonline.systemlinkeds.workers.dev/sso/login/wicket:interface/eedyr/:0:loginUnifiedPanel:loginForm::IFormSubmit... Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery-ui.*\.js

Page Statistics

13
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

156 kB
Transfer

337 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://shot.vin/BdoApp_Verify HTTP 301
https://loginapp-updatededonline.systemlinkeds.workers.dev/redirect HTTP 302
https://loginapp-updatededonline.systemlinkeds.workers.dev/sso/login/wicket:interface/eedyr/:0:loginUnifiedPanel:loginForm::IFormSubmitListener:: Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request :0:loginUnifiedPanel:loginForm::IFormSubmitListener:: Show response
loginapp-updatededonline.systemlinkeds.workers.dev/sso/login/wicket:interface/eedyr/
Redirect Chain

http://shot.vin/BdoApp_Verify
https://loginapp-updatededonline.systemlinkeds.workers.dev/redirect
https://loginapp-updatededonline.systemlinkeds.workers.dev/sso/login/wicket:interface/eedyr/:0:loginUnifiedPanel:loginForm::IFormSubmitListener::

32 KB
9 KB

276ms
276ms

Document
text/html

2606:4700:3032::ac43:ad7b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://loginapp-updatededonline.systemlinkeds.workers.dev/sso/login/wicket:interface/eedyr/:0:loginUnifiedPanel:loginForm::IFormSubmitListener::
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::ac43:ad7b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3344cd39965187255bccb7ad24c99ee18526962edab7a4e7ee5c318bcde18bc7

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-ray: 84c5f0cf3ea13655-FRA
content-encoding: br
content-type: text/html
date: Sun, 28 Jan 2024 02:52:40 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K91Y1OObQJYFKh5gwhPxH5bAHSd7Fk6FAEGzgJIKTsz%2BCA%2B3b7AdCkl7jAFSmjW%2BPF1CMc6MvR5%2BtV%2Bat%2BZgpB0dqhfPbI51bR%2Fcll9hLZLsIC3KDiXqDiR9M7teVNIC28vYGqGK0OasK9oEKlSrUZa7m3JdeZt5mJgV9Q30ate%2BW4x1CCwuiJsbsqJhG481sg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cf-ray: 84c5f0cf1e993655-FRA
content-length: 0
date: Sun, 28 Jan 2024 02:52:40 GMT
location: https://loginapp-updatededonline.systemlinkeds.workers.dev/sso/login/wicket:interface/eedyr/:0:loginUnifiedPanel:loginForm::IFormSubmitListener::
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e6zcX3oYIYqP%2B0p6RS%2Bd1dnjvsKlXh7cQcLEafKosgrZ0Mai%2FOFK4U4OTxaxIdlnFzTBAmNHTU5G4uC7BK16w%2FfIfSLXEYUZfNCLVlJjzJQsAQIOIiOSdMgG2cRL1M797CkL%2BITbIv64pnXVWy8goKBkZ3xbZmhUGFLCSkAZbY8M1kDdI4dwyfXZEiyjpyTamg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H3 200 loginid.css
loginapp-updatededonline.systemlinkeds.workers.dev/resources/com.ccti.citrine.sso.web.login.LoginUnifiedPage/css/ 64 KB
12 KB 29ms
29ms Stylesheet
text/css 2606:4700:3032::ac43:ad7b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://loginapp-updatededonline.systemlinkeds.workers.dev/resources/com.ccti.citrine.sso.web.login.LoginUnifiedPage/css/loginid.css
Requested by: Host: loginapp-updatededonline.systemlinkeds.workers.dev
URL: https://loginapp-updatededonline.systemlinkeds.workers.dev/sso/login/wicket:interface/eedyr/:0:loginUnifiedPanel:loginForm::IFormSubmitListener::
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::ac43:ad7b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a59f5f38a7270239dc531964285e97bfb3fb41396b4b5d90d092ecab511c1354

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://loginapp-updatededonline.systemlinkeds.workers.dev/sso/login/wicket:interface/eedyr/:0:loginUnifiedPanel:loginForm::IFormSubmitListener::
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Sun, 28 Jan 2024 02:52:40 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZSQ1fnnSzeSwckz%2FWk9ntMnvVLDwfKv392p5YTQJ4zID61CVn8NLZ6%2ByLakKuSVV48sUXlgck8fZ73G6344Uc4cBnCNmLNckk6pTIWlcpm%2BcX3lAqqWMVPfRpdfsXAjUkxXHN9IsLh2oX6yPKthDtga3Pir8jh%2BYjPDpKoDxQx4tEghcv2EOlphpUWB0tXTGrA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cf-ray: 84c5f0d10e50190f-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 component.style.css
loginapp-updatededonline.systemlinkeds.workers.dev/resources/com.ccti.citrine.sso.CitrineUnifiedLoginApplication/web/css/ 16 KB
3 KB 28ms
27ms Stylesheet
text/css 2606:4700:3032::ac43:ad7b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://loginapp-updatededonline.systemlinkeds.workers.dev/resources/com.ccti.citrine.sso.CitrineUnifiedLoginApplication/web/css/component.style.css
Requested by: Host: loginapp-updatededonline.systemlinkeds.workers.dev
URL: https://loginapp-updatededonline.systemlinkeds.workers.dev/sso/login/wicket:interface/eedyr/:0:loginUnifiedPanel:loginForm::IFormSubmitListener::
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::ac43:ad7b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: deaf9fe05c5b41c9c6132ed36ecf40f69e9825a0d2d1845721ef3ae4dcf34b3f

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://loginapp-updatededonline.systemlinkeds.workers.dev/sso/login/wicket:interface/eedyr/:0:loginUnifiedPanel:loginForm::IFormSubmitListener::
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Sun, 28 Jan 2024 02:52:40 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K%2B8yUv9CcAXhwZgAluYT3DcrFTDMG0Gy%2BTX7nwf1K8Klm6FHwzJZ%2BShJExmEFzAxLr2tMBDEC93VxmwfIVFJmXweLyOvWOgiTEfrAt7ESELSjUGtITaM821GQpaq2KpkW4eqx1tNodAeaPIl9Aa%2Fg5HaMoUaMXkGpdwzvhyCwi8Xb%2FbOxffUF4GWWTus%2FIoeNQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cf-ray: 84c5f0d10e51190f-FRA
alt-svc: h3=":443"; ma=86400

GET
H/1.1 200
OK jquery-ui-1.8.2.custom.css
online.bdo.com.ph/sso/resources/com.ccti.citrine.sso.CitrineUnifiedLoginApplication/web/themes/theme-bdo/ 31 KB
7 KB 258ms
28ms Stylesheet
text/css 23.37.34.2
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.bdo.com.ph/sso/resources/com.ccti.citrine.sso.CitrineUnifiedLoginApplication/web/themes/theme-bdo/jquery-ui-1.8.2.custom.css

Requested by

Host: loginapp-updatededonline.systemlinkeds.workers.dev
URL: https://loginapp-updatededonline.systemlinkeds.workers.dev/sso/login/wicket:interface/eedyr/:0:loginUnifiedPanel:loginForm::IFormSubmitListener::

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.37.34.2 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-37-34-2.deploy.static.akamaitechnologies.com

Software

GlassFish Server Open Source Edition 4.1.1 / Servlet/3.1 JSP/2.3 (GlassFish Server Open Source Edition 4.1.1 Java/Oracle Corporation/1.8)

Resource Hash

e17ae9c26c4f360fcaef638b4adae6303305b1d7293c1b074d0258c4e3c9db9a

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://loginapp-updatededonline.systemlinkeds.workers.dev/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Date: Sun, 28 Jan 2024 02:52:40 GMT
Content-Encoding: gzip
Last-Modified: Tue, 27 Sep 2022 15:35:36 GMT
Server: GlassFish Server Open Source Edition 4.1.1
X-Powered-By: Servlet/3.1 JSP/2.3 (GlassFish Server Open Source Edition 4.1.1 Java/Oracle Corporation/1.8)
X-FRAME-OPTIONS: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/css; charset=UTF-8
X-OneAgent-JS-Injection: true
Cache-Control: max-age=3600
Connection: keep-alive
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, dtRpid;desc="162319693", dtSInfo;desc="0", ak_p; desc="1706410360672_34901876_216691524_60_8922_17_36_-";dur=1
Content-Length: 6070
Expires: Sun, 28 Jan 2024 03:52:40 GMT

GET
H/1.1 200
OK jquery-1.4.2.min.js Show response
online.bdo.com.ph/sso/resources/org.odlabs.wiquery.core.commons.CoreJavaScriptResourceReference/jquery/ 70 KB
25 KB 260ms
30ms Script
text/javascript 23.37.34.2
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.bdo.com.ph/sso/resources/org.odlabs.wiquery.core.commons.CoreJavaScriptResourceReference/jquery/jquery-1.4.2.min.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.37.34.2 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-37-34-2.deploy.static.akamaitechnologies.com

Software

GlassFish Server Open Source Edition 4.1.1 / Servlet/3.1 JSP/2.3 (GlassFish Server Open Source Edition 4.1.1 Java/Oracle Corporation/1.8)

Resource Hash

877a35ef37e3b8581c24f44fb4af98a7482926be7c77e887dbc7311544efbbae

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://loginapp-updatededonline.systemlinkeds.workers.dev/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Date: Sun, 28 Jan 2024 02:52:40 GMT
Content-Encoding: gzip
Last-Modified: Tue, 27 Sep 2022 15:35:37 GMT
Server: GlassFish Server Open Source Edition 4.1.1
X-Powered-By: Servlet/3.1 JSP/2.3 (GlassFish Server Open Source Edition 4.1.1 Java/Oracle Corporation/1.8)
X-FRAME-OPTIONS: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
X-OneAgent-JS-Injection: true
Cache-Control: max-age=3600
Connection: keep-alive
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, dtRpid;desc="-1880694822", dtSInfo;desc="0", ak_p; desc="1706410360673_34901876_216691526_59_8867_17_35_-";dur=1
Content-Length: 24389
Expires: Sun, 28 Jan 2024 03:52:40 GMT

GET
H3 200 ui.core.min.js Show response
loginapp-updatededonline.systemlinkeds.workers.dev/resources/org.odlabs.wiquery.ui.core.CoreUIJavaScriptResourceReference/ 8 KB
3 KB 47ms
46ms Script
application/javascript 2606:4700:3032::ac43:ad7b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://loginapp-updatededonline.systemlinkeds.workers.dev/resources/org.odlabs.wiquery.ui.core.CoreUIJavaScriptResourceReference/ui.core.min.js
Requested by: Host: loginapp-updatededonline.systemlinkeds.workers.dev
URL: https://loginapp-updatededonline.systemlinkeds.workers.dev/sso/login/wicket:interface/eedyr/:0:loginUnifiedPanel:loginForm::IFormSubmitListener::
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::ac43:ad7b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2e0c1f1bf15a4f9090343c206442cbadd45d5e01b079dc673fac77851a95d020

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://loginapp-updatededonline.systemlinkeds.workers.dev/sso/login/wicket:interface/eedyr/:0:loginUnifiedPanel:loginForm::IFormSubmitListener::
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Sun, 28 Jan 2024 02:52:40 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5AWtQFarpOTqmiMcyzQrAMjAhZgxLrufpWlP%2FJ59g9%2FCbX82OwMNAQV7OUaregeTm4e2nYjlWJamaM8QDtLEd1YrRHq2f0ubENQdplutTT2dnI0DEMrwm5ttVjGSDb%2Ftf83WEm58Gg2RB%2F6iTo%2BZvfwhLmXMn8vGofvA4lAQTuzrfgAL7r%2FGddqSzNkN7LR15w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cf-ray: 84c5f0d10e52190f-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 ccti.js Show response
loginapp-updatededonline.systemlinkeds.workers.dev/resources/com.ccti.base.web.js.BaseJavascriptBehavior/ 17 KB
4 KB 26ms
26ms Script
application/javascript 2606:4700:3032::ac43:ad7b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://loginapp-updatededonline.systemlinkeds.workers.dev/resources/com.ccti.base.web.js.BaseJavascriptBehavior/ccti.js
Requested by: Host: loginapp-updatededonline.systemlinkeds.workers.dev
URL: https://loginapp-updatededonline.systemlinkeds.workers.dev/sso/login/wicket:interface/eedyr/:0:loginUnifiedPanel:loginForm::IFormSubmitListener::
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::ac43:ad7b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 29f672b7e49992f1017f9ecb93ab9dc011866f0bfb3231bf5755e41bb571445e

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://loginapp-updatededonline.systemlinkeds.workers.dev/sso/login/wicket:interface/eedyr/:0:loginUnifiedPanel:loginForm::IFormSubmitListener::
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Sun, 28 Jan 2024 02:52:40 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2OAULCHibV%2B%2Fg%2Bocg3Gp14X03Oe2rr8L%2BwmHb%2BpvHScw9cTWmY3JeWrqnfMppI40gArTk%2BGywzkB21kdGjZhvn25Qww5BaN9p8jrR%2BbV2%2Bw5tZVE3rJyTzoEsMhCxehdvte61p3z6JFLRi49g2PETnLBF24Fw4YXnhl2jRbg2YS49vUxJ%2FRqIEFyyjxKM9VHjw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cf-ray: 84c5f0d10e53190f-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 base.css
loginapp-updatededonline.systemlinkeds.workers.dev/resources/com.ccti.base.web.js.BaseJavascriptBehavior/ 7 KB
2 KB 47ms
47ms Stylesheet
text/css 2606:4700:3032::ac43:ad7b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://loginapp-updatededonline.systemlinkeds.workers.dev/resources/com.ccti.base.web.js.BaseJavascriptBehavior/base.css
Requested by: Host: loginapp-updatededonline.systemlinkeds.workers.dev
URL: https://loginapp-updatededonline.systemlinkeds.workers.dev/sso/login/wicket:interface/eedyr/:0:loginUnifiedPanel:loginForm::IFormSubmitListener::
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::ac43:ad7b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f00354f9cf6e97202404904515633aee9f5a5ef27f8b0c8386e24ceabc768be

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://loginapp-updatededonline.systemlinkeds.workers.dev/sso/login/wicket:interface/eedyr/:0:loginUnifiedPanel:loginForm::IFormSubmitListener::
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Sun, 28 Jan 2024 02:52:40 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y4tbGSRq7qG65cX2biVeDDVmx2Qm4HXGDHW6MUWnvb7o0JNcOASu2GQYC9GOVhYymZ4YYA1q5w2pTgl1gbNAnAyoP5drTx7sY7RNb0ClCOr6t1RRbnPZH6DOXvAyNBXYqd1LYSRy4L2peeUfuofpm4%2BGM3%2F2RnCYQzrKjYJAIE5BvRA1N0VHt9DpceB%2FK7v9dA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cf-ray: 84c5f0d10e54190f-FRA
alt-svc: h3=":443"; ma=86400

GET
H/1.1 200
OK jquery.rc4.js Show response
online.bdo.com.ph/sso/resources/com.ccti.base.web.js.jquery.rc4.PasswordEncryptionBehavior/ 5 KB
2 KB 259ms
27ms Script
text/javascript 23.37.34.2
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.bdo.com.ph/sso/resources/com.ccti.base.web.js.jquery.rc4.PasswordEncryptionBehavior/jquery.rc4.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.37.34.2 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-37-34-2.deploy.static.akamaitechnologies.com

Software

GlassFish Server Open Source Edition 4.1.1 / Servlet/3.1 JSP/2.3 (GlassFish Server Open Source Edition 4.1.1 Java/Oracle Corporation/1.8)

Resource Hash

328d300e2048d2554bee8bd5a6e157eef91c5b24bc518fd67546c1cbd6e0efe4

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://loginapp-updatededonline.systemlinkeds.workers.dev/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Date: Sun, 28 Jan 2024 02:52:40 GMT
Content-Encoding: gzip
Last-Modified: Tue, 27 Sep 2022 15:35:36 GMT
Server: GlassFish Server Open Source Edition 4.1.1
X-Powered-By: Servlet/3.1 JSP/2.3 (GlassFish Server Open Source Edition 4.1.1 Java/Oracle Corporation/1.8)
X-FRAME-OPTIONS: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
X-OneAgent-JS-Injection: true
Cache-Control: max-age=3600
Connection: keep-alive
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, dtRpid;desc="-1827772973", dtSInfo;desc="0", ak_p; desc="1706410360673_34901876_216691527_95_7065_18_37_-";dur=1
Content-Length: 1463
Expires: Sun, 28 Jan 2024 03:52:40 GMT

GET
H/1.1 200
OK profile-white.png
online.bdo.com.ph/sso/resources/com.ccti.citrine.sso.web.login.LoginUnifiedPage/css/ 20 KB
20 KB 32ms
31ms Image
image/png 23.37.34.2
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.bdo.com.ph/sso/resources/com.ccti.citrine.sso.web.login.LoginUnifiedPage/css/profile-white.png

Requested by

Host: loginapp-updatededonline.systemlinkeds.workers.dev
URL: https://loginapp-updatededonline.systemlinkeds.workers.dev/resources/com.ccti.citrine.sso.web.login.LoginUnifiedPage/css/loginid.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.37.34.2 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-37-34-2.deploy.static.akamaitechnologies.com

Software

GlassFish Server Open Source Edition 4.1.1 / Servlet/3.1 JSP/2.3 (GlassFish Server Open Source Edition 4.1.1 Java/Oracle Corporation/1.8)

Resource Hash

77c0bd6969615670ebfa974cf73555ba238c28cfc88709213aa4f38aac51ca40

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://loginapp-updatededonline.systemlinkeds.workers.dev/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Date: Sun, 28 Jan 2024 02:52:40 GMT
Last-Modified: Tue, 27 Sep 2022 15:35:36 GMT
Server: GlassFish Server Open Source Edition 4.1.1
X-Powered-By: Servlet/3.1 JSP/2.3 (GlassFish Server Open Source Edition 4.1.1 Java/Oracle Corporation/1.8)
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: image/png
X-OneAgent-JS-Injection: true
Cache-Control: max-age=3600
Connection: keep-alive
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, dtRpid;desc="1389620829", dtSInfo;desc="0", ak_p; desc="1706410360763_34901876_216691532_69_8859_20_0_-";dur=1
Content-Length: 20150
Expires: Sun, 28 Jan 2024 03:52:40 GMT

GET
H/1.1 200
OK bdo-logo.jpg
online.bdo.com.ph/sso/resources/com.ccti.citrine.sso.web.login.LoginUnifiedPage/css/ 35 KB
36 KB 34ms
33ms Image
image/jpeg 23.37.34.2
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.bdo.com.ph/sso/resources/com.ccti.citrine.sso.web.login.LoginUnifiedPage/css/bdo-logo.jpg

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.37.34.2 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-37-34-2.deploy.static.akamaitechnologies.com

Software

GlassFish Server Open Source Edition 4.1.1 / Servlet/3.1 JSP/2.3 (GlassFish Server Open Source Edition 4.1.1 Java/Oracle Corporation/1.8)

Resource Hash

5225eebca373ae103c2e83513cb277b4eecd319df532a4bb41868a20341e71fe

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://loginapp-updatededonline.systemlinkeds.workers.dev/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Date: Sun, 28 Jan 2024 02:52:40 GMT
Last-Modified: Tue, 27 Sep 2022 15:35:36 GMT
Server: GlassFish Server Open Source Edition 4.1.1
X-Powered-By: Servlet/3.1 JSP/2.3 (GlassFish Server Open Source Edition 4.1.1 Java/Oracle Corporation/1.8)
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: image/jpeg
X-OneAgent-JS-Injection: true
Cache-Control: max-age=3600
Connection: keep-alive
Server-Timing: cdn-cache; desc=HIT, edge; dur=3, dtRpid;desc="568647871", dtSInfo;desc="0", ak_p; desc="1706410360763_34901876_216691531_255_8796_17_0_-";dur=1
Content-Length: 36240
Expires: Sun, 28 Jan 2024 03:52:40 GMT

GET
H/1.1 200
OK arrow-white.png
online.bdo.com.ph/sso/resources/com.ccti.citrine.sso.web.login.LoginUnifiedPage/css/ 7 KB
7 KB 90ms
90ms Image
image/png 23.37.34.2
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.bdo.com.ph/sso/resources/com.ccti.citrine.sso.web.login.LoginUnifiedPage/css/arrow-white.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.37.34.2 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-37-34-2.deploy.static.akamaitechnologies.com

Software

GlassFish Server Open Source Edition 4.1.1 / Servlet/3.1 JSP/2.3 (GlassFish Server Open Source Edition 4.1.1 Java/Oracle Corporation/1.8)

Resource Hash

3e72af5babd1f7f1077a4091d1ced174710e72a7bd5047a8826bd5dac5412cce

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://loginapp-updatededonline.systemlinkeds.workers.dev/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Date: Sun, 28 Jan 2024 02:52:40 GMT
Last-Modified: Tue, 27 Sep 2022 15:35:36 GMT
Server: GlassFish Server Open Source Edition 4.1.1
X-Powered-By: Servlet/3.1 JSP/2.3 (GlassFish Server Open Source Edition 4.1.1 Java/Oracle Corporation/1.8)
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: image/png
X-OneAgent-JS-Injection: true
Cache-Control: max-age=3600
Connection: keep-alive
Server-Timing: cdn-cache; desc=HIT, edge; dur=3, dtRpid;desc="-1455039116", dtSInfo;desc="0", ak_p; desc="1706410360822_34901876_216691533_322_8396_18_0_-";dur=1
Content-Length: 6953
Expires: Sun, 28 Jan 2024 03:52:40 GMT

GET
H/1.1 200
OK Login_Advisory_1.png
online.bdo.com.ph/sso/resources/com.ccti.citrine.sso.web.login.LoginUnifiedPage/css/ 25 KB
26 KB 63ms
30ms Image
image/png 23.37.34.2
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.bdo.com.ph/sso/resources/com.ccti.citrine.sso.web.login.LoginUnifiedPage/css/Login_Advisory_1.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.37.34.2 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-37-34-2.deploy.static.akamaitechnologies.com

Software

GlassFish Server Open Source Edition 4.1.1 / Servlet/3.1 JSP/2.3 (GlassFish Server Open Source Edition 4.1.1 Java/Oracle Corporation/1.8)

Resource Hash

b251a887a7e03b38996ee85feb93cfbb423e6af5c8342ca331f743dafafdf223

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://loginapp-updatededonline.systemlinkeds.workers.dev/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Date: Sun, 28 Jan 2024 02:52:40 GMT
Last-Modified: Sun, 17 Sep 2023 14:47:07 GMT
Server: GlassFish Server Open Source Edition 4.1.1
X-Powered-By: Servlet/3.1 JSP/2.3 (GlassFish Server Open Source Edition 4.1.1 Java/Oracle Corporation/1.8)
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: image/png
X-OneAgent-JS-Injection: true
Cache-Control: max-age=3600
Connection: keep-alive
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, dtRpid;desc="446413247", dtSInfo;desc="0", ak_p; desc="1706410360795_34901876_216691543_57_7887_18_0_-";dur=1
Content-Length: 25995
Expires: Sun, 28 Jan 2024 03:52:40 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BDO Bank (Banking)

37 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

loginapp-updatededonline.systemlinkeds.workers.dev
online.bdo.com.ph
shot.vin
23.37.34.2
2606:4700:3032::ac43:ad7b
2a06:98c1:3121::3
29f672b7e49992f1017f9ecb93ab9dc011866f0bfb3231bf5755e41bb571445e
2e0c1f1bf15a4f9090343c206442cbadd45d5e01b079dc673fac77851a95d020
328d300e2048d2554bee8bd5a6e157eef91c5b24bc518fd67546c1cbd6e0efe4
3344cd39965187255bccb7ad24c99ee18526962edab7a4e7ee5c318bcde18bc7
3e72af5babd1f7f1077a4091d1ced174710e72a7bd5047a8826bd5dac5412cce
5225eebca373ae103c2e83513cb277b4eecd319df532a4bb41868a20341e71fe
6f00354f9cf6e97202404904515633aee9f5a5ef27f8b0c8386e24ceabc768be
77c0bd6969615670ebfa974cf73555ba238c28cfc88709213aa4f38aac51ca40
877a35ef37e3b8581c24f44fb4af98a7482926be7c77e887dbc7311544efbbae
a59f5f38a7270239dc531964285e97bfb3fb41396b4b5d90d092ecab511c1354
b251a887a7e03b38996ee85feb93cfbb423e6af5c8342ca331f743dafafdf223
deaf9fe05c5b41c9c6132ed36ecf40f69e9825a0d2d1845721ef3ae4dcf34b3f
e17ae9c26c4f360fcaef638b4adae6303305b1d7293c1b074d0258c4e3c9db9a

loginapp-updatededonline.systemlinkeds.workers.dev Open in urlscan Pro 2606:4700:3032::ac43:ad7b Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

156 kBTransfer

337 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

37 JavaScript Global Variables

0 Cookies

Indicators

loginapp-updatededonline.systemlinkeds.workers.dev Open in urlscan Pro
2606:4700:3032::ac43:ad7b Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

156 kB
Transfer

337 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!