Philippine dotPH Registry Automatically Serves Ads to Unregistered Domains

[jasongodev]

I've been investigating this peculiar behavior of .ph domains for the past week. Anyone can search urlscan.io using the query page.domain:(/.+.ph/) and will see massive number of .ph domains being scanned.

The domains seem to be from an active phishing campaigns as they include popular names of banks and payment apps like Paypal, CTBC Bank, Deutsche Bank, etc.

However, closer investigation shows that almost all of them are unregistered. For example the first and last domains in the screenshot I provided:

Going to each of their individual scans shows that they do serve content despite being unregistered.

Looks like the official domain registry of the Philippines, dotPH, is automatically parking any unregistered domain that touched one of their ccTLD - .ph, .com.ph, .net.ph, and .org.ph.

Testing this hypothesis proved to be successful for the following random domains:

• test-1791306703.ph: https://urlscan.io/result/01a11234-fce7-76bd-ab64-7ac83102c479/
• random-1791306704.com.ph: https://urlscan.io/result/01a11235-aff5-7227-bc22-882b7ba1913d/
• demo-1791306705.net.ph: https://urlscan.io/result/01a11236-ea9a-775d-984d-94aa8a8c5c02/
• try-1791306706.org.ph: https://urlscan.io/result/01a11238-3323-767a-8c13-9e0cd79a589e/

Here's the beautified html code of test-1791306703.ph and random-1791306704.com.ph

test-1791306703.ph

<!doctype html>
<html lang="en">

<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width,initial-scale=1">
    <title>Redirecting...</title>
    <style>
        #loading{position:fixed;top:50%;left:50%;transform:translate(-50%,-50%);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;font-size:48px;font-weight:600;color:#000}#loading .dot{animation:loading-blink 1.4s infinite both}#loading .dot:first-child{animation-delay:.2s}#loading .dot:nth-child(2){animation-delay:.4s}#loading .dot:nth-child(3){animation-delay:.6s}@keyframes loading-blink{0%,100%,80%{opacity:0}40%{opacity:1}}
    </style>
</head>

<body>
    <div id="loading" role="status" aria-label="Loading">Loading<span class="dot">.</span><span class="dot">.</span><span class="dot">.</span></div>
    <script>
        (()=>{"use strict";const e="offset",t="client",o=function(){};let n=!1,r=!1;const i={loopDelay:50,maxLoop:5,complete:o},a=[];let s=null;const l={cssClass:"ad-overlay google-ad-bottom-outer prebid-wrapper .dfp-ad-container"},u={nullProps:[e+"Parent"],zeroProps:[]};u.zeroProps=[e+"Height",e+"Left",e+"Top",e+"Width",e+"Height",t+"Height",t+"Width"];const c={quick:null,remote:null};let d=null;const p={test:0,download:0};function f(e){return"function"==typeof e}function m(e){!0!==d&&(r=!0,y(e),c.quick="testing",p.test=setTimeout((function(){h(e,1)}),5))}function y(e){let t,o,n=document.body,r="width: 1px !important; height: 1px !important; position: absolute !important; left: -10000px !important; top: -1000px !important;";if(null!=e&&"string"!=typeof e){for(null!=e.style&&(r+=e.style),s=function(e,t){let o,n,r=t;if(n=document.createElement(e),r)for(o in r)r.hasOwnProperty(o)&&n.setAttribute(o,r[o]);return n}("div",{class:e.cssClass,style:r}),n.appendChild(s),t=0;t<u.nullProps.length;t++)o=s[u.nullProps[t]];for(t=0;t<u.zeroProps.length;t++)o=s[u.zeroProps[t]]}}function h(e,t){const o=document.body;let c=!1;if(null==s&&y(e||l),"string"!=typeof e){p.test>0&&(clearTimeout(p.test),p.test=0),null!==o.getAttribute("abp")&&(c=!0);for(let e=0;e<u.nullProps.length;e++){if(null==s[u.nullProps[e]]){t>4&&(c=!0);break}if(!0===c)break}for(let e=0;e<u.zeroProps.length&&!0!==c;e++)0===s[u.zeroProps[e]]&&t>4&&(c=!0);if(void 0!==window.getComputedStyle){const e=window.getComputedStyle(s,null);"none"!==e.getPropertyValue("display")&&"hidden"!==e.getPropertyValue("visibility")||t>4&&(c=!0)}n=!0,c||t++>=i.maxLoop?(d=c,function(){let e,t;if(null===d)return;for(e=0;e<a.length;e++){t=a[e];try{null!=t&&f(t["complete"])&&t["complete"](d)}catch(e){return}}}(),g()&&setTimeout((function(){r=!1}),5)):p.test=setTimeout((function(){h(e,t)}),i.loopDelay)}else g()&&setTimeout((function(){r=!1}),5)}function g(){if(null===s)return!0;try{f(s.remove)&&s.remove(),document.body.removeChild(s)}catch(e){}return s=null,!0}var w=function(e){if(!e)return;const t={complete:o,found:o,notfound:o};let n;for(n in e)e.hasOwnProperty(n)&&("complete"===n||"found"===n||"notFound"===n?t[n.toLowerCase()]=e[n]:i[n]=e[n]);a.push(t),function(){let e,t=!1;document.readyState&&"complete"===document.readyState&&(t=!0),e=function(){m(l)},t?e():window.addEventListener("load",e)}()};function b(){document.write(`<a id="Lf5Bwk4VUwckRGlsodUE1cfaRyQBxT1O" href="/.IGV0hOcNusVJOgqoD1HuWTk0PssdueKB"></a>`),document.getElementById("Lf5Bwk4VUwckRGlsodUE1cfaRyQBxT1O").click()}function v(e){return`${e}`}async function P(e){const t=await async function(e,t){const o=Uint8Array.from(atob(e),(e=>e.charCodeAt(0))),n=JSON.parse((new TextDecoder).decode(o));return n.parameters.adBlockingDetected=t,n.parameters.isIframe=window.self!==window.top,n.parameters.refererBrowser=document.referrer,n.parameters.timezoneBrowser=Intl.DateTimeFormat().resolvedOptions().timeZone,n.parameters.timezoneOffset=(new Date).getTimezoneOffset(),n.parameters.webdriver=navigator.webdriver,n.parameters.gpu=await async function(){if(!navigator.gpu)return null;const e=await navigator.gpu.requestAdapter();if(!e)return null;if(e.info&&e.info.vendor)return e.info.vendor;if(e.requestAdapterInfo){const t=await e.requestAdapterInfo();return t.vendor?t.vendor:null}return null}(),JSON.stringify(n)}("eyJwYXJhbWV0ZXJzIjp7ImNvbnRpbmVudCI6IkFTIiwicHJvdG9jb2wiOiJodHRwIiwidGltZXpvbmVHZW8iOiJBc2lhXC9NYW5pbGEiLCJ1dWlkIjoiMDA1Y2M1NTVkODdhZjg1ZGE0ZWRmMzAyMDg4N2NjMWIiLCJjb3VudHJ5IjoiUEgiLCJ0ZW5hbnQiOiJkb3RwaC1ueGQiLCJyZWdpb25OYW1lIjoiTWV0cm8gTWFuaWxhIiwicmVnaW9uIjoiMDAiLCJwYXRoIjoiXC8iLCJjaXR5IjoiTWFuaWxhIiwiY29udGluZW50TmFtZSI6IkFzaWEiLCJjb3VudHJ5TmFtZSI6IlBoaWxpcHBpbmVzIiwiZG9tYWluQXBleCI6InRlc3QtMTc5MTMwNjcwMy5waCIsImRvbWFpbkZ1bGwiOiJ0ZXN0LTE3OTEzMDY3MDMucGgiLCJpcE9yaWciOiIxMzYuMTU4LjYwLjU0In19",e);(async function(e,t){const o=new XMLHttpRequest;o.onreadystatechange=_,o.open("POST",e,!0),o.send(t)})("https://router.parklogic.com/",t).then()}function T(e){document.body.innerHTML=e,document.body.querySelectorAll("script").forEach((e=>{const t=document.createElement("script");for(const o of e.attributes)t.setAttribute(o.name,o.value);t.innerHTML=e.innerHTML,e.parentNode.replaceChild(t,e)}))}function _(){var e;4===this.readyState&&(200!==this.status&&console.error(`failed to contact router, status code: ${this.status} "${this.statusText}"`),this.responseText.startsWith("http")?(e=this.responseText,"true"===v("false")?(document.cookie=`m6RW96QaECHb2mXiRi7YQBqlkYuoZc7A=${btoa(e)};max-age=5`,b()):window.location.replace(e)):T(this.responseText))}"true"===v("true")?w({complete:e=>{e?"true"===v("false")?(document.cookie="Nsj7rdlN8X5lOGh3PoZezs9aS9Eqq3VK=1;max-age=5","true"===v("false")?b():location.reload()):P(!0):P(!1)}}):P()})();
    </script>
</body>

</html>

random-1791306704.com.ph

<!doctype html>
<html lang="en">

<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width,initial-scale=1">
    <title>Redirecting...</title>
    <style>
        #loading{position:fixed;top:50%;left:50%;transform:translate(-50%,-50%);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;font-size:48px;font-weight:600;color:#000}#loading .dot{animation:loading-blink 1.4s infinite both}#loading .dot:first-child{animation-delay:.2s}#loading .dot:nth-child(2){animation-delay:.4s}#loading .dot:nth-child(3){animation-delay:.6s}@keyframes loading-blink{0%,100%,80%{opacity:0}40%{opacity:1}}
    </style>
</head>

<body>
    <div id="loading" role="status" aria-label="Loading">Loading<span class="dot">.</span><span class="dot">.</span><span class="dot">.</span></div>
    <script>
        (()=>{"use strict";const e="offset",t="client",o=function(){};let n=!1,r=!1;const i={loopDelay:50,maxLoop:5,complete:o},a=[];let s=null;const l={cssClass:"ad-overlay google-ad-bottom-outer prebid-wrapper .dfp-ad-container"},u={nullProps:[e+"Parent"],zeroProps:[]};u.zeroProps=[e+"Height",e+"Left",e+"Top",e+"Width",e+"Height",t+"Height",t+"Width"];const c={quick:null,remote:null};let d=null;const p={test:0,download:0};function f(e){return"function"==typeof e}function m(e){!0!==d&&(r=!0,y(e),c.quick="testing",p.test=setTimeout((function(){h(e,1)}),5))}function y(e){let t,o,n=document.body,r="width: 1px !important; height: 1px !important; position: absolute !important; left: -10000px !important; top: -1000px !important;";if(null!=e&&"string"!=typeof e){for(null!=e.style&&(r+=e.style),s=function(e,t){let o,n,r=t;if(n=document.createElement(e),r)for(o in r)r.hasOwnProperty(o)&&n.setAttribute(o,r[o]);return n}("div",{class:e.cssClass,style:r}),n.appendChild(s),t=0;t<u.nullProps.length;t++)o=s[u.nullProps[t]];for(t=0;t<u.zeroProps.length;t++)o=s[u.zeroProps[t]]}}function h(e,t){const o=document.body;let c=!1;if(null==s&&y(e||l),"string"!=typeof e){p.test>0&&(clearTimeout(p.test),p.test=0),null!==o.getAttribute("abp")&&(c=!0);for(let e=0;e<u.nullProps.length;e++){if(null==s[u.nullProps[e]]){t>4&&(c=!0);break}if(!0===c)break}for(let e=0;e<u.zeroProps.length&&!0!==c;e++)0===s[u.zeroProps[e]]&&t>4&&(c=!0);if(void 0!==window.getComputedStyle){const e=window.getComputedStyle(s,null);"none"!==e.getPropertyValue("display")&&"hidden"!==e.getPropertyValue("visibility")||t>4&&(c=!0)}n=!0,c||t++>=i.maxLoop?(d=c,function(){let e,t;if(null===d)return;for(e=0;e<a.length;e++){t=a[e];try{null!=t&&f(t["complete"])&&t["complete"](d)}catch(e){return}}}(),g()&&setTimeout((function(){r=!1}),5)):p.test=setTimeout((function(){h(e,t)}),i.loopDelay)}else g()&&setTimeout((function(){r=!1}),5)}function g(){if(null===s)return!0;try{f(s.remove)&&s.remove(),document.body.removeChild(s)}catch(e){}return s=null,!0}var w=function(e){if(!e)return;const t={complete:o,found:o,notfound:o};let n;for(n in e)e.hasOwnProperty(n)&&("complete"===n||"found"===n||"notFound"===n?t[n.toLowerCase()]=e[n]:i[n]=e[n]);a.push(t),function(){let e,t=!1;document.readyState&&"complete"===document.readyState&&(t=!0),e=function(){m(l)},t?e():window.addEventListener("load",e)}()};function b(){document.write(`<a id="Lf5Bwk4VUwckRGlsodUE1cfaRyQBxT1O" href="/.IGV0hOcNusVJOgqoD1HuWTk0PssdueKB"></a>`),document.getElementById("Lf5Bwk4VUwckRGlsodUE1cfaRyQBxT1O").click()}function v(e){return`${e}`}async function P(e){const t=await async function(e,t){const o=Uint8Array.from(atob(e),(e=>e.charCodeAt(0))),n=JSON.parse((new TextDecoder).decode(o));return n.parameters.adBlockingDetected=t,n.parameters.isIframe=window.self!==window.top,n.parameters.refererBrowser=document.referrer,n.parameters.timezoneBrowser=Intl.DateTimeFormat().resolvedOptions().timeZone,n.parameters.timezoneOffset=(new Date).getTimezoneOffset(),n.parameters.webdriver=navigator.webdriver,n.parameters.gpu=await async function(){if(!navigator.gpu)return null;const e=await navigator.gpu.requestAdapter();if(!e)return null;if(e.info&&e.info.vendor)return e.info.vendor;if(e.requestAdapterInfo){const t=await e.requestAdapterInfo();return t.vendor?t.vendor:null}return null}(),JSON.stringify(n)}("eyJwYXJhbWV0ZXJzIjp7ImNvbnRpbmVudE5hbWUiOiJBc2lhIiwiY29udGluZW50IjoiQVMiLCJkb21haW5BcGV4IjoicmFuZG9tLTE3OTEzMDY3MDQuY29tLnBoIiwiZG9tYWluRnVsbCI6InJhbmRvbS0xNzkxMzA2NzA0LmNvbS5waCIsImlwT3JpZyI6IjEzNi4xNTguNjAuNTQiLCJjb3VudHJ5IjoiUEgiLCJyZWdpb24iOiIwMCIsInJlZ2lvbk5hbWUiOiJNZXRybyBNYW5pbGEiLCJ0aW1lem9uZUdlbyI6IkFzaWFcL01hbmlsYSIsInV1aWQiOiJmN2ZmNDg1M2FmZTY1MzU0ODFlNjVmYTkwYTc0YTUyZCIsInRlbmFudCI6ImRvdHBoLW54ZCIsInByb3RvY29sIjoiaHR0cCIsInBhdGgiOiJcLyIsImNvdW50cnlOYW1lIjoiUGhpbGlwcGluZXMiLCJjaXR5IjoiTWFuaWxhIn19",e);(async function(e,t){const o=new XMLHttpRequest;o.onreadystatechange=_,o.open("POST",e,!0),o.send(t)})("https://router.parklogic.com/",t).then()}function T(e){document.body.innerHTML=e,document.body.querySelectorAll("script").forEach((e=>{const t=document.createElement("script");for(const o of e.attributes)t.setAttribute(o.name,o.value);t.innerHTML=e.innerHTML,e.parentNode.replaceChild(t,e)}))}function _(){var e;4===this.readyState&&(200!==this.status&&console.error(`failed to contact router, status code: ${this.status} "${this.statusText}"`),this.responseText.startsWith("http")?(e=this.responseText,"true"===v("false")?(document.cookie=`m6RW96QaECHb2mXiRi7YQBqlkYuoZc7A=${btoa(e)};max-age=5`,b()):window.location.replace(e)):T(this.responseText))}"true"===v("true")?w({complete:e=>{e?"true"===v("false")?(document.cookie="Nsj7rdlN8X5lOGh3PoZezs9aS9Eqq3VK=1;max-age=5","true"===v("false")?b():location.reload()):P(!0):P(!1)}}):P()})();
    </script>
</body>

</html>

These are almost identical codes except for some base64 encoded strings that are related to redirection payload.

The source code and the IP addresses 45.79.222.138, 172.234.216.100, and 2600:3c06::f03c:95ff:fed9:ce5e are all related to ParkLogic, a domain monetization platform for parked domains.

This is a clear proof that dotPH registry is automatically parking any unregistered domain to ParkLogic which then redirects to random advertisements. These advertisements are most of the time related to gambling and NSFW content.

In conclusion, any unregistered .ph domain that also redirects to a ParkLogic-served advertisement is likely false positive for phishing.