TSPY_DYRE.XXA
VirTool:Win32/Injector.AEK (Microsoft), Trojan.Win32.Yakes.micp (Kaspersky), a variant of Win32/Kryptik.DXDA (ESET-NOD32), Trojan.Win32.Yakes.dxdvou (NANO-Antivirus)
Windows
Threat Type: Spyware
Destructiveness: No
Encrypted: Yes
In the wild: Yes
OVERVIEW
Downloaded from the Internet
This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.
It connects to certain websites to send and receive information.
TECHNICAL DETAILS
484,352 bytes
EXE
Yes
21 Sep 2015
Connects to URLs/IPs
Arrival Details
This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This spyware drops the following copies of itself into the affected system:
- %AppDataLocal%\{random filename}.exe (for Windows Vista and above)
- %Windows%\{random filename}.exe (for Windows XP and below)
(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)
It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.
It adds the following mutexes to ensure that only one of its copies runs at any one time:
- Global\{random}
It injects codes into the following process(es):
- svchost.exe
- explorer.exe
Autostart Technique
The scheduled task executes the malware every:
- 1 minute
Other System Modifications
This spyware modifies the following registry entries:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Lsa
LimitBlankPasswordUse = 0
(Note: The default value data of the said registry entry is 1.)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Terminal Server
fDenyTSConnections = 0
(Note: The default value data of the said registry entry is 1.)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Terminal Server
fSingleSessionPerUser = 0
(Note: The default value data of the said registry entry is 1.)
Dropping Routine
This spyware drops the following files:
- %System%\config\systemprofile\AppData\Local\{random filename} (for Windows Vista and above)
- %AppDataLocal%\{random filename} (for Windows XP and below}
(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)
Information Theft
This spyware gathers the following data:
- Host Name
- Public IP Address
- Computer Name
- OS Version
- OS Platform
- User Accounts
- System Info(CPU, Memory, No. of Processors)
- Installed programs
- Services
Other Details
This spyware connects to the following URL(s) to check for an Internet connection:
- google.com
- microsoft.com
It connects to the following URL(s) to get the affected system's IP address:
- http://icanhazip.com
It connects to the following website to send and receive information:
- http://{BLOCKED}.{BLOCKED}.220.8:443
- http://{BLOCKED}.{BLOCKED}.226.85:443
- http://{BLOCKED}.{BLOCKED}.48.147:443
- http://{BLOCKED}.{BLOCKED}.49.139:443
- http://{BLOCKED}.{BLOCKED}.49.162:443
- http://{BLOCKED}.{BLOCKED}.166.94:4443
- http://{BLOCKED}.{BLOCKED}.48.79:443
- http://{BLOCKED}.{BLOCKED}.50.124:4443
- http://{BLOCKED}.{BLOCKED}.201.9:443
- http://{BLOCKED}.{BLOCKED}.153.202:443
- http://{BLOCKED}.{BLOCKED}.64.35:4443
- http://{BLOCKED}.{BLOCKED}.84.55:443
- http://{BLOCKED}.{BLOCKED}.194.101:4443
- http://{BLOCKED}.{BLOCKED}.38.100:443
- http://{BLOCKED}.{BLOCKED}.77.76:443
- http://{BLOCKED}.{BLOCKED}.104.102:443
- http://{BLOCKED}.{BLOCKED}.58.42:4443
- http://{BLOCKED}.{BLOCKED}.60.93:4443
- http://{BLOCKED}.{BLOCKED}.135.106:4443
- http://{BLOCKED}.{BLOCKED}.101.2:4443
- http://{BLOCKED}.{BLOCKED}.204.37:443
- http://{BLOCKED}.{BLOCKED}.237.115:443
- http://{BLOCKED}.{BLOCKED}.146.107:4443
- http://{BLOCKED}.{BLOCKED}.146.67:4443
- http://{BLOCKED}.{BLOCKED}.147.103:4443
- http://{BLOCKED}.{BLOCKED}.156.105:4443
- http://{BLOCKED}.{BLOCKED}.156.165:443
- http://{BLOCKED}.{BLOCKED}.156.216:4443
- http://{BLOCKED}.{BLOCKED}.57.164:4443
- http://{BLOCKED}.{BLOCKED}.228.117:4443
- http://{BLOCKED}.{BLOCKED}.176.230:4443
- http://{BLOCKED}.{BLOCKED}.191.170:443
- http://{BLOCKED}.{BLOCKED}.63.207:443
- http://{BLOCKED}.{BLOCKED}.51.115:4443
- http://{BLOCKED}.{BLOCKED}.116.76:443
- http://{BLOCKED}.{BLOCKED}.45.149:443
- http://{BLOCKED}.{BLOCKED}.45.40:443
- http://{BLOCKED}.{BLOCKED}.241.26:443
- http://{BLOCKED}.{BLOCKED}.244.187:443
NOTES:
This spyware does the following:
- Add users
- Browser snapshot
- Connects to the following STUN (Session Traversal Utilities for NAT) server in order to determine the public IP address of the compromised computer:
- stun1.voiceeclipse.net
- stun.callwithus.com
- stun.sipgate.net
- stun.ekiga.net
- stun.internetcalls.com
- stun.noc.ams-ix.net
- stun.voip.aebc.com
- stun.voipbuster.com
- stun.voxgratia.org
- stun.ipshka.com
- stun.faktortel.com.au
- stun.iptel.org
- stun.voipstunt.com
- 203.183.172.196:3478
- s1.taraba.net
- stun.l.google.com:19302
- stun1.l.google.com:19302
- stun2.l.google.com:19302
- stun3.l.google.com:19302
- stun4.l.google.com:19302
- stun.schlund.de
- stun.rixtelecom.se
- stun.voiparound.com
- numb.viagenie.ca
- stun.stunprotocol.org
- stun.services.mozilla.com
- stun.2talk.co.nz
- Download file and execute
- Download module (VNC, TV)
- Modifies Master Boot Record (MBR)
- Monitors the following browsers:
- chrome.exe
- firefox.exe
- iexplore.exe
- Receive configuration(web injects/MitB)
- Receive New connections
- Shutdown/restart system
- Stop the following services:
- wscsvc
- MpsSvc
- WinDefend
- Terminate Process
It steals important banking/bitcoin information by injecting malicious codes to bank/Bitcoin login webpages with URLs containing any of the following:
- *-banking.at/*/tiles/favicon.ico[?]*
- *-banking.at/*/tiles/start.action*
- *-g*-enligne.*.fr/stb/entreeBam*
- *-g*-enligne.*.fr/stb/favicon.ico[?]*
- *.*/OnlineBankingWebfrontend/banking/common/favicon.ico[?]*
- *.*/OnlineBankingWebfrontend/banking/common/login.xhtml*
- *.anz.com*
- *.blilk.com/Core/Authentication/favicon.ico[?]*
- *.blilk.com/Core/Authentication/MFA*
- *.bsibank.com/bsi_login_auth/login*
- *.ch*/auth/login*
- *.ch_login/favicon.ico[?]*
- *.com/fi*/*/*
- *.com/fi*/*/favicon.ico[?]*
- *.com/pub/html/favicon.ico[?]*
- *.com/pub/html/login.html*
- *.com/SPF/Login/Auth.aspx*
- *.com/SPF/Login/favicon.ico[?]*
- *.de/favicon.ico[?]*
- *.de/loginStart.do*
- *.de/portal/porta/favicon.ico[?]
- *.de/portal/portal/*
- *.ebanking-services.com/*
- *.ebanking-services.com/*/favicon.ico[?]*
- *.ediweb.ca-*.fr/*/login*.jsp*
- *.ediweb.ca-*.fr/favicon.ico[?]*
- *.ibps.*.banquepopulaire.fr*
- *.ibps.*.banquepopulaire.fr/favicon.ico[?]*
- *.icgauth.banquepopulaire.fr*
- *.icgauth.banquepopulaire.fr/favicon.ico[?]*
- *.westpac.com.au/esis/Login/SrvPage*
- *.westpac.com.au/secure/banking/*
- */_mcologon*
- */Accounts/AccountOverview.asp*
- */appl/ebp/*.html*
- */appl/ebp/favicon.ico[?]*
- */auth/login?favicon.ico[?]*
- */Authentication/favicon.ico[?]*
- */Authentication/Login*
- */bbw/clientPub/*
- */bbw/cmserver/*
- */bbw/cmserver/welcome/default/favicon.ico[?]*
- */bbw/dashboard/*
- */bsi_login_auth/favicon.ico[?]*
- */business/*favicon.ico[?]*
- */business/cts_security_precheck*
- */business/j_security_check*
- */business/login/Login.jsp*
- */cgi-bin/hbproxy.exe/*
- */cgi-bin/hbproxy.exe/favicon.ico[?]*
- */dciweb.htm*/favicon.ico[?]*
- */dciweb.htm*?p0=idesai.tht&t=p*
- */ebankingLogin/favicon.ico[?]*
- */ebankingLogin/login?*
- */EBC_EBC1961/*
- */EBC_EBC1961/favicon.ico[?]*
- */ebranch/login/login.aspx*
- */engine/login/favicon.ico[?]*
- */hbnet/accountinfo/balances.aspx?*
- */hbnet/app*
- */hbnet/login/login.aspx*
- */InternetBanking/InternetBanking*
- */InternetBanking/InternetBanking/favicon.ico[?]*
- */ISuite5/Features/Auth/MFA/Default.aspx*
- */ISuite5/Features/Auth/MFA/IFrameLoginMFA.aspx*
- */ISuite5/Features/Auth/MFA/iFrameLoginMFABrandableSingleLine.aspx*
- */ISuite5/Features/Auth/MFA/Login/MFALoginChallengeUser.aspx*
- */ISuite5/Features/Auth/MFA/Login/MFALoginEnrolledPassword.aspx*
- */ISuite5/Features/LandingPage.aspx*
- */isum/favicon.ico[?]*
- */isum/Main?ISUM_SCR=login&loginType=accesoSeguro&ISUM_Portal*
- */login_auth/favicon.ico[?]*
- */LoginAdv.aspx?qs=*
- */logincenter/login.wf*
- */logincenter/login.wf/favicon.ico[?]*
- */onlinebanking-*/favicon.ico[?]*
- */onlinebanking-*/loginFormAction.*
- */onlineserv/CM*
- */onlineserv/CM/favicon.ico[?]*
- */onlineserv/HB/Signon.cgi*
- */outil/UAUT*
- */outil/UAUT*favicon.ico[?]*
- */PassMarkRecognizedAdv.aspx?qs=*
- */session.lyo*
- */SignOn.aspx?qs=*
- */tob/live/usp-core/app/initialLogin
- */tob/live/usp-core/app/login/consumer
- */wcmfd/*
- */wcmfd/*/favicon.ico[?]*
- *activa24.ccm.es*
- *activa24.ccm.es/favicon.ico[?]*
- *activobank.com*
- *activobank.com/favicon.ico[?]*
- *alandsbanken*/ebank/auth/*.do*
- *alandsbanken*/ebank/auth/favicon.ico[?]*
- *allianzbanque.fr*
- *allianzbanque.fr/favicon.ico[?]*
- *arvest*.com*
- *arvest.com/favicon.ico[?]*
- *associatedbank.com*
- *associatedbank.com/favicon.ico[?]*
- *authenticate/login/selectauth*
- *authenticate/login/selectauth/favicon.ico[?]*
- *bancaadistancia*es*
- *bancaadistancia*es/favicon.ico[?]*
- *bancofarnet.bancofar.es*
- *bancofarnet.bancofar.es/favicon.ico[?]*
- *bancomer.com*
- *bancomer.com/favicon.ico[?]*
- *bancopopular.es*
- *bancopopular.es/favicon.ico[?]*
- *bancosabadellfr.com*
- *bancosabadellfr.com/favicon.ico[?]*
- *bancsabadell.com*
- *bancsabadell.com/favicon.ico[?]*
- *banking.*/onlinebanking*/favicon.ico[?]*
- *banking.*/onlinebanking*/loginFormAction.*
- *bankinter.com*
- *bankinter.com/favicon.ico[?]*
- *bankoaonline.com*
- *bankoaonline.com/favicon.ico[?]*
- *bankofmelbourne.com.au/ibank/*
- *banque-*.fr*
- *banque-*.fr/favicon.ico[?]*
- *banquedelareunion.fr*
- *banquedelareunion.fr/favicon.ico[?]*
- *banqueprivee1818.com*
- *banqueprivee1818.com/favicon.ico[?]*
- *barclays.fr*
- *barclays.fr/favicon.ico[?]*
- *bbv.com.ar*
- *bbv.com.ar/favicon.ico[?]*
- *bbva.*
- *bbva.*/favicon.ico[?]*
- *bbvacontinental.pe*
- *bbvacontinental.pe/favicon.ico[?]*
- *bbvanet.com.co*
- *bbvanet.com.co/favicon.ico[?]*
- *be.ceca.es*
- *be.ceca.es/favicon.ico[?]*
- *bfsonline.es*
- *bfsonline.es/favicon.ico[?]*
- *bhf-bank.com/favicon.ico[?]*
- *bhf-bank.com/w3/*index.*.jsp*
- *bmn.es*
- *bmn.es/favicon.ico[?]*
- *bv-activebanking.de/*/favicon.ico[?]*
- *bv-activebanking.de/*/loginFormAction.*
- *caixa-enginyers.com*
- *caixa-enginyers.com/favicon.ico[?]*
- *caixaontinyent.es*
- *caixaontinyent.es/favicon.ico[?]*
- *caja-ingenieros.es*
- *caja-ingenieros.es/favicon.ico[?]*
- *cajamar.es*
- *cajamar.es/favicon.ico[?]*
- *cajasur.es*
- *cajasur.es/favicon.ico[?]*
- *card-data.com/CardManagementSystem/Security/Login.aspx*
- *card-data.com/ComericaCardManagementSystem/Security/Login.aspx
- *card-data.com/RegionsCardManagementSystem/Security/Login.aspx
- *catalunyacaixa.com*
- *catalunyacaixa.com/favicon.ico[?]*
- *cetelem.es*
- *cetelem.es/favicon.ico[?]*
- *cey-ebanking.com/CLKCCM/*
- *cey-ebanking.com/CLKCCM/favicon.ico[?]*
- *cic.fr*
- *cic.fr/favicon.ico[?]*
- *cm-cic-bail.com*
- *cm-cic-bail.com/favicon.ico[?]*
- *commbank.com.au*
- *commerzbank*
- *commerzbank.*/favicon.ico[?]*
- *consorsbank.de*
- *consorsbank.de/favicon.ico[?]*
- *corporatebankingweb/core/*
- *corporatebankingweb/core/favicon.ico[?]*
- *creatis.fr*
- *creatis.fr/favicon.ico[?]*
- *credit-du-nord.fr*
- *credit-du-nord.fr/favicon.ico[?]*
- *creditmutuel.fr*
- *creditmutuel.fr/favicon.ico[?]*
- *dab-bank.de*
- *dab-bank.de/favicon.ico[?]*
- *ebanking*.ch/ebankingLogin/*
- *ebanking*/login_auth/login/?*
- *ediweb.credit-agricole.fr/*/login*.jsp*
- *ediweb.credit-agricole.fr/favicon.ico[?]*
- *efirstbank.com*
- *efirstbank.com/favicon.ico[?]*
- *engine/login/businesslogin*
- *entreprises*lcl.fr*
- *entreprises*lcl.fr/favicon.ico[?]*
- *entreprises.natixis.com*
- *entreprises.natixis.com/favicon.ico[?]*
- *es@b/fr/codeident.jsp*
- *es@b/fr/favicon.ico[?]*
- *espaciojovenuni.com*
- *espaciojovenuni.com/favicon.ico[?]*
- *ffb.de*
- *ffb.de/favicon.ico[?]*
- *finconsum.es*
- *finconsum.es/favicon.ico[?]*
- *ib.nab.com.au/nabib*
- *inbiz.intesasanpaolo.com*
- *inbiz.intesasanpaolo.com/favicon.ico[?]*
- *internetbanking.suncorpbank.com.au*
- *konto.*/favicon.ico[?]*
- *konto.*/loginFormAction.*
- *kutxabank.es*
- *kutxabank.es/favicon.ico[?]*
- *laboralkutxa.com*
- *laboralkutxa.com/favicon.ico[?]*
- *lacaixa.es*
- *lacaixa.es/favicon.ico[?]*
- *liberbankbancaprivada.es*
- *liberbankbancaprivada.es/favicon.ico[?]*
- *myvirtualbranch.com*
- *myvirtualbranch.com/*/favicon.ico[?]*
- *nettbedriften.evry.com/cpsnbg2/cpsnbg2/favicon.ico[?]*
- *nettbedriften.evry.com/cpsnbg2/cpsnbg2/main?bankid*
- *netteller.com/login2008/*
- *netteller.com/login2008/Authentication/Views/favicon.ico[?]*
- *online.bank-abc.com*
- *online.bank-abc.com/favicon.ico[?]*
- *onlinebank.com/*
- *onlinebank.com/favicon.ico[?]*
- *palatine.fr*
- *palatine.fr/favicon.ico[?]*
- *pankki/kirjautuminen*
- *pankki/kirjautuminen/favicon.ico[?]*
- *pib*.secure-banking.com/*
- *pib*.secure-banking.com/*/favicon.ico[?]*
- *portal.citidirect.com/*/forms/*
- *portal.citidirect.com/*/forms/*favicon.ico[?]
- *portalbank.no/bsl/do/slogin*
- *portalbank.no/bsl/do/slogin/favicon.ico[?]*
- *portalbank.no/wsl/slogin*
- *portalbank.no/wsl/slogin/favicon.ico[?]*
- *s-pankki*
- *s-pankki/favicon.ico[?]*
- *secure-banking.de/ItrexsWeb/favivon.ico[?]*
- *secure-banking.de/ItrexsWeb/ValidateLogin*
- *secure.fundsxpress.com/piles/favicon.ico[?]*
- *secure.fundsxpress.com/piles/fxweb.pile/*
- *smc.fr*
- *smc.fr/favicon.ico[?]*
- *sparda*.de*
- *sparda*.de/favicon.ico[?]*
- *stgeorge.com.au/ibank/*
- *synovus*
- *synovus.com/favicon.ico[?]*
- *tapiola*/ebank/auth/*.do*
- *tapiola*/ebank/auth/favicon.ico[?]*
- *tarneaud.fr*
- *tarneaud.fr/favicon.ico[?]*
- *ubibanca.com*
- *ubibanca.com/favicon.ico[?]*
- *umb.com*
- *umb.com/favicon.ico[?]*
- *unicaja*es*
- *unicaja*es/favicon.ico[?]*
- *uno-e.com*
- *uno-e.com/favicon.ico[?]*
- *verbund*
- *verbund/favicon.ico[?]*
- *volkswagenbank.de*
- *volkswagenbank.de/favicon.ico[?]*
- *websteronline.com/favicon.ico[?]*
- *weinhandl*
- *weinhandl/favicon.ico[?]*
- *wuestenrot*
- *wuestenrot/favicon.ico[?]*
- *www.eq.fi*
- *www.eq.fi/favicon.ico[?]*
- *www.evli.com*
- *www.evli.com/favicon.ico[?]*
- *www.op.fi*
- *www.op.fi/favicon.ico[?]*
- *wwwsec.*.ch*/login*
- *zionsbank.com*
- *zionsbank.com/favicon.ico[?]*
- /ISuite5/Features/Preferences/MFA/MFASecuritySettings.aspx
- abconline.arabbanking.com/*
- abconline.arabbanking.com/abconlinen/login.asp
- accentbranding.com/about-us/customer-login*
- accesd.affaires.desjardins.com/*
- accesd.affaires.desjardins.com/en/ada
- accesd.affaires.desjardins.com/fr/ada
- access.alivefulfillment.com/*
- access.jpmorgan.com/*
- access.jpmorgan.com/jpmalogon*
- access.usbank.com/*
- access.usbank.com/cpsApp1/AxolPreAuthServlet*
- accountmaint.fidelity.com/ftgw/Profile/action/profile?hint=coainq
- accounts.logme.in/login.aspx*
- accountsetup.fidelity.com/ftgw/bene/maint/summary
- admin.epymtservice.com/*
- admin.epymtservice.com/admin/index.jhtml*
- advertisers.careerone.com.au/login.aspx*
- advisor.fidelity.com/app/account/list*
- afactorcontact.com/*
- afactorcontact.com/ClientManagerCMA/formulaire.html
- aibinternetbanking.aib.ie/*
- aibinternetbanking.aib.ie/inet/roi/login.htm*
- akp.aab.de/*
- akp.aab.de/akp/vermoegensstatus/uebersicht.do
- aliorbank.pl/*
- aliorbank.pl/hades/do/Login
- alolb1.arbuthnotlatham.co.uk/*
- alolb1.arbuthnotlatham.co.uk/IB/Online*
- ambank.amonline.com.my/
- ambank.amonline.com.my/*
- amsweb.catella.se/*
- amsweb.catella.se/catella/login.htm
- an.rbcnetbank.com/
- an.rbcnetbank.com/*
- annit.osuuspankki.fi/*
- annit.osuuspankki.fi/oprextranet/default.asp
- ap.ebs.bankofchina.com/*
- ap.ebs.bankofchina.com/login.html*
- app.atcostfulfillment.com/
- app.atcostfulfillment.com/home
- app.secservizi.it/*
- app.secservizi.it/CommonApps/shared/vb/tesoweb/loginTesowebGVB.html
- app.shipwire.com/sign-in*
- apps.bhw.de/*
- apps.bhw.de/es600/index.jsp*
- apps.virginmoney.com/*
- apps.virginmoney.com/vmosws/loginWait.do*
- at-directnet.credit-suisse.com/*
- at-directnet.credit-suisse.com/dn/c/cls/auth
- attijariconnect.attijariwafa.com/
- attijariconnect.attijariwafa.com/*
- attijarinet.attijariwafa.com/*
- attijarinet.attijariwafa.com/entreprise/
- attijarinet.attijariwafa.com/particulier/
- au-services.credit-suisse.com/*
- au-services.credit-suisse.com/cs/ibip/frontend/c/cls/auth
- auth.aktia.fi/*
- auth.aktia.fi/corporatenetbank
- auth.aktia.fi/netbank
- auth.aktia.fi/tunnistus/UI/Login
- auth.aktia.fi/tupas
- auth.globalpay.westernunion.com/*
- auth.globalpay.westernunion.com/Sso/Login.aspx*
- aw.rbcnetbank.com/
- aw.rbcnetbank.com/*
- bancaelectronica.evobanco.com/
- bancaelectronica.evobanco.com/*
- bancodicaribeonline.com/*
- bancodicaribeonline.com/aua/SIGNON.CFM
- bancodicaribeonline.com/SIGNON.CFM
- bancodicaribeonline.com/sxm/SIGNON.CFM
- bancoonline.openbank.es/*
- bancoonline.openbank.es/servlet/PProxy*
- bank.barclays.co.uk/*
- bank.barclays.co.uk/olb/auth/LoginLink.action*
- bank.ruralbank.com.au/*
- bank.ruralbank.com.au/banking/RBLIBanking*
- bank.storebrand.no
- bank.storebrand.no/*
- banken.amfabank.se/*
- banken.amfabank.se/wa/auth*
- bankieren.rabobank.nl/*
- bankieren.rabobank.nl/klanten
- bankieren.triodos.nl/*
- bankieren.triodos.nl/ib-seam/login.seam
- banking.bankofscotland.co.uk/*
- banking.bankofscotland.co.uk/Logon/Logon.aspx*
- banking.bankofscotland.de/*
- banking.bankofscotland.de/netbanking/RetailLoginHome.html
- banking.bekb.ch/*
- banking.bekb.ch/ident.html
- banking.beyondbank.com.au/*
- banking.beyondbank.com.au/daib/logon/cu5022/logon.asp
- banking.bmwbank.de/
- banking.bmwbank.de/*
- banking.bmwbank.de/s/b2cpws.fcc*
- banking.bw-bank.de
- banking.bw-bank.de/*
- banking.capitalone.com/
- banking.capitalone.com/[?]*
- banking.donner-reuschel.de/*
- banking.donner-reuschel.de/index.jsp*
- banking.dvbbank.com/
- banking.dvbbank.com/*
- banking.greensill-bank.com/*
- banking.greensill-bank.com/ptlweb/WebPortal*
- banking.ing-diba.at/*
- banking.ing-diba.at/online-banking
- banking.ing-diba.de/*
- banking.ing-diba.de/app/login*
- banking.ing-diba.de/app/obligo
- banking.ireland-bank.com/*
- banking.ireland-bank.com/IrelandBankOnline_303/Authentication/Login.aspx*
- banking.lloydsbank.com/*
- banking.lloydsbank.com/Logon/logon.aspx
- banking.lloydsbank.nl/*
- banking.lloydsbank.nl/netbankingnl/RetailLoginHome.html
- banking.martinbank.de/
- banking.martinbank.de/*
- banking.oberbank.de/*
- banking.oberbank.de/smartoffice/de/_mcologon*
- banking.oberbank.de/smartoffice/de/logon.htm
- banking.oyakankerbank.de
- banking.oyakankerbank.de/*
- banking.oyakankerbank.de/[?]*
- banking.postbank.de/*
- banking.postbank.de/rai/login
- banking.secure.bnl.it/
- banking.secure.bnl.it/*
- banking.smile.co.uk/*
- banking.smile.co.uk/SmileWeb/start.do*
- banking.triodos.co.uk/*
- banking.triodos.co.uk/ib-seam/login.seam?loginType=dp550*
- banking.triodos.co.uk/ib-seam/login.seam?loginType=username*
- banking.valovisbank.de/*
- banking.valovisbank.de/portal/*
- banking.varengold.de/*
- banking.varengold.de/OnlineBankingWebfrontend/banking/common/login.xhtml;jsessionid=6B6D8E978F9BF46846D30C85AF534497*
- bankinguk.secure.investec.com/*
- bankinguk.secure.investec.com/login.html*
- bankofirelandlifeonline.ie/
- bankofirelandlifeonline.ie/*
- bankonline.sboff.com/*
- bankonline.sboff.com/OFS2/InternetBanking*
- bankonweb.sgeb.bg/*
- bankonweb.sgeb.bg/page/default.aspx*
- banque.bfcoi.com/*
- banque.bfcoi.com/identificationClient.html*
- banques.exalog.net/*
- banques.exalog.net/authent.php*
- barclaysnet.barclays.es/*
- barclaysnet.barclays.es/accesoBarclaysNet.html
- basfnet.france.banqueaudi.com/*
- basfnet.france.banqueaudi.com/cnet/Arc_NbOrion_html/Banque/Static_BASF/netbank_en.html
- basfnet.france.banqueaudi.com/cnet/Arc_NbOrion_html/Banque/Static_BASF/netbank_fr.html
- bbmy.ocbc.com/*
- bbmy.ocbc.com/baliweb/59341/site/defaultskin/en_US/html/static/logon_box.htm
- bbonline.bankofmelbourne.com.au/*
- bbonline.bankofmelbourne.com.au/html/cbank.asp*
- bbonline.banksa.com.au/*
- bbonline.banksa.com.au/html/cbank.asp*
- bbonline.stgeorge.com.au/*
- bbonline.stgeorge.com.au/html/cbank.asp*
- bbonline.stgeorge.com.au/html/cbindex.asp*
- bcaixanet-empresas.bancocaixageral.es/
- bcaixanet-empresas.bancocaixageral.es/*
- bcaixanet-particulares.bancocaixageral.es/
- bcaixanet-particulares.bancocaixageral.es/*
- be.abanca.com/
- be.abanca.com/*
- bebank.bpel.net/*
- bebank.bpel.net/bpel-web/virty/login.cfm
- bizpermonline.newcastlepermanent.com.au/*
- bizpermonline.newcastlepermanent.com.au/NPBSBusiness
- blcweb.banquelaurentienne.ca/*
- blcweb.banquelaurentienne.ca/lang/en/BLCDirect*
- blcweb.banquelaurentienne.ca/lang/fr/BLCDirect*
- bob.santanderbank.com/LGSVBS_NS_ENS/ChannelDriver.ssobto
- bol.westpac.co.nz/*
- bol.westpac.co.nz/s1gcb/logon/sbuser*
- bolpp.bankofireland.com/*
- bolpp.bankofireland.com/Commercial*
- bourse.cholet-dupont.fr/*
- bourse.cholet-dupont.fr/login.asp
- boursebesv.besv.fr/*
- boursebesv.besv.fr/fr/index.html
- br.credit-suisse.com/*
- br.credit-suisse.com/sec/login/default.aspx
- bs-services.credit-suisse.com/*
- bs-services.credit-suisse.com/cs/ibip/frontend/c/cls/auth*
- btultra.btrl.ro/*
- btultra.btrl.ro/sign/_mcologon*
- btultra.btrl.ro/signm/036PRS.lyo*
- bureau.bottomline.co.uk/*
- bureau.bottomline.co.uk/unity/index.aspx*
- business-eb.ibanking-services.com/*
- business-eb.ibanking-services.com/K1/index.jsp*
- business.co-operativebank.co.uk/*
- business.co-operativebank.co.uk/corp/BANKAWAY*
- business.firstcitizensonline.com/*
- business.firstcitizensonline.com/cb/pages/jsp-ns/loginfcbsc.jsp
- business.memberdirect.net/*
- business.memberdirect.net/business/default.jsp*
- business.santander.co.uk/*
- business.santander.co.uk/LGSBBI_NS_ENS*/ChannelDriver.ssobto*
- business.santander.co.uk/LGSBBI_NS_ENS/BtoChannelDriver.ssobto*
- business.santander.co.uk/SBBI_Accounts_ENS/BtoChannelDriver.ssobto?*dse_operationName=MyAccounts*
- business.santander.co.uk/SBBI_ServiceRequest_ENS/BtoChannelDriver.ssobto?dse_encryptData=*dse_operationName=ChangeContactDetails
- business2.danskebank.co.uk/*
- business2.danskebank.co.uk/pub/logon/logon.aspx*
- business2.danskebank.com/*
- business2.danskebank.com/pub/logon/logon.aspx*
- business2.danskebank.dk/*
- business2.danskebank.dk/pub/logon/logon.aspx*
- business2.danskebank.ie/*
- business2.danskebank.ie/pub/logon/logon.aspx*
- business2.danskebank.no/*
- business2.danskebank.no/pub/logon/logon.aspx*
- businessaccess.citibank.citigroup.com/*
- businessaccess.citibank.citigroup.com/cbusol/signon.do*
- businessbank.tsbbank.co.nz/*
- businessbank.tsbbank.co.nz/BusinessBank/login.jsp
- businessbanking.tdcommercialbanking.com/*
- businessbanking.tdcommercialbanking.com/WBB/LoginDisplay*
- businesscenter.mysynchrony.com/*
- businesscenter.mysynchrony.com/BusinessCenterPortal*
- businessonline.huntington.com/*
- businessonline.huntington.com/BOLHome/BusinessOnlineLogin.aspx
- businessonline.mutualofomahabank.com/*
- businessonline.mutualofomahabank.com/cb/pages/jsp-ns/login.jsp*
- businessonline.tdbank.com/*
- businessonline.tdbank.com/corporatebankingweb/core/login.aspx*
- businessonline.westpac.com.au/*
- businessonline.westpac.com.au/esis/Login/SrvPage*
- butterfieldonline.co.uk/
- butterfieldonline.co.uk/*
- bywebcard.bancopopolare.it/*
- bywebcard.bancopopolare.it/preLogin.asp
- caixadirecta.colonya.es/*
- caixadirecta.colonya.es/BEWeb/2056/6056/inicia_identificacion.action*
- caixadirecta.colonya.es/BEWeb/2056/6056/login_identificacion.action
- cardonebanking.com/*
- cardonebanking.com/authlogin.aspx*
- cardonebanking.com/authlogin.aspx?business*
- carigeonline.gruppocarige.it/*
- carigeonline.gruppocarige.it/wps8ib/portal*
- casextern.creditplus.de/*
- casextern.creditplus.de/casextern_prod1/login
- cashmanagement.barclays.net/*
- cashmanagement.barclays.net/portalservices/forms/login.pser*
- cashmanager.mizuhoe-treasurer.com/*
- cashmanager.mizuhoe-treasurer.com/mz/servlet/SLogin*
- cashproonline.bankofamerica.com/*
- cashproonline.bankofamerica.com/*/cpo*public*
- catalystcorp.org/*
- cbfm.saas.cashfac.com/*
- cbfm.saas.cashfac.com/cbfm/Logon.aspx*
- cbforex.citizenscommercialbanking.com/*
- cbforex.citizenscommercialbanking.com/CitizensWebApplication/cbforex/loginScreen*
- cbionline.cbi.ae/*
- cbionline.cbi.ae/bus/security/Welcome.do*
- certificat.banques.exalog.net/authent.php*
- cfi.mb.seb.se/*
- cfi.mb.seb.se/pqq_portal/sebflow/login
- cgacontact.c-g-a.fr/*
- cgacontact.c-g-a.fr/ClientManagerSG/formulaire.html
- cgaetoile.c-g-a.fr/*
- cgaetoile.c-g-a.fr/ClientManagerCDN/formulaire.html
- cgaoi.c-g-a.fr/*
- cgaoi.c-g-a.fr/ClientManagerOI/formulaire.html
- cgi-hp.espace-clients.fr/
- cgi-hp.espace-clients.fr/*
- charisma.btdirect.ro/*
- charisma.btdirect.ro/CharismaWEB/_Public/Login.aspx*
- chaseonline.chase.com/
- chaseonline.chase.com/Logon.aspx*
- chaseonline.chase.com/MyAccounts.aspx
- chaseonline.chase.com/secure/Profile/UpdateContactInfo/UpdateContact.aspx
- chaseonline.chase.com/snapshoot/1
- cib.affinonline.com/*
- cib.affinonline.com/business/login.html
- cib.bankofthewest.com/*
- cib.bankofthewest.com/K1/servlet/com.fis.authentication.servlet.WelcomeServlet*
- cib.icicibank.com/*
- cib.icicibank.com/corp/BANKAWAY*
- cib.natixis.com/*
- cib.natixis.com/net/default.aspx
- cib.uab.ae/
- cib.uab.ae/*
- cityntl.webcashmgmt.com/*
- cityntl.webcashmgmt.com/wcmfd/wcmpw/CustomerLogin*
- classic.nordea.fi/*
- classic.nordea.fi/cgi-bin/SOLO0001*
- client.gemoneybank.fr/*
- client.gemoneybank.fr/identification.do
- client.schwab.com/Accounts/BrokerageBalances/BrokerageBalances.aspx
- client.schwab.com/Accounts/Summary/Summary.aspx*
- client.schwab.com/Login/SignOn/CustomerCenterLogin.aspx*
- client.schwab.com/secure/cc/accounts/history
- client.schwab.com/secure/cc/accounts/positions
- client.schwab.com/secure/cc/accounts/summary
- client.schwab.com/secure/cc/service/my_profile/emailaddress
- client.schwab.com/Service/MyProfile/MailingAddress.aspx
- client.schwab.com/snapshoot/70
- clientes.selfbank.es/*
- clientes.selfbank.es/conexion
- clientes.selfbank.es/login.phtml
- clientes.uci.es
- clientes.uci.es/*
- clientlogin.ibb.ubs.com/*
- clientlogin.ibb.ubs.com/login*
- clientpoint.fisglobal.com/*
- clientpoint.fisglobal.com/tdcb/main/UserLogon*
- clientportal.ibb.ubs.com/*
- clientportal.ibb.ubs.com/portal/index.htm*
- clients.banque-fiducial.fr/*
- clients.banque-fiducial.fr/comptes/fr/index.htm
- clients.tilneybestinvest.co.uk/*
- clients.tilneybestinvest.co.uk/ORM/Login.aspx*
- clientview-mx.credit-suisse.com/*
- clientview-mx.credit-suisse.com/pb/mexico/c/cls/auth
- cmbdirect.cmbnv.com/*
- cmbdirect.cmbnv.com/business/online*
- cmo.cibc.com/*
- cmo.cibc.com/wp/wps/portal/bbdsignon*
- cmol.bbt.com/*
- cmol.bbt.com/auth/prompt.tb*
- coi.netxinvestor.com/web/coi/login*
- commerceconnections.commercebank.com/
- commerceconnections.commercebank.com/*
- commercial.bnc.ca/*
- commercial.bnc.ca/auth/Login*
- companynet.mbank.pl/*
- companynet.mbank.pl/mt/
- companynet.mbank.pl/mt/fragments/cua/login.jsp*
- conecta.es.rbcis.com/*
- conecta.es.rbcis.com/person-online/dologin
- conecta.es.rbcis.com/tafval
- connect-ch2.ubs.com/*
- connect-ch2.ubs.com/workbench/Index.do*
- connect.bnymellon.com/*
- connect.bnymellon.com/ConnectLogin/login/LoginPage.jsp*
- connect.secure.wellsfargo.com/auth/login/present*
- connexis.bnpparibas.com
- connexis.bnpparibas.com/*
- corporate.adcb.com/*
- corporate.adcb.com/corporateWeb/login.do*
- corporate.metrobankonline.co.uk/
- corporate.metrobankonline.co.uk/*
- corporate.santander.co.uk/LOGSCU_NS_ENS/BtoChannelDriver.bto*
- corporate.santander.co.uk/LOGSUK_NS_ENS/ChannelDriver.ssobto*
- cpe.erste-group.com
- cpe.erste-group.com/*
- cpn.hsbc.com.mx/*
- cpn.hsbc.com.mx/cpn/default.htm*
- creditors.kaupthing.com/*
- creditors.kaupthing.com/default.aspx*
- cs.directnet.com/*
- cs.directnet.com/dn/c/cls/auth*
- cs1.credistar.com/*
- cs1.credistar.com/p/
- db-direct.db.com/*
- db-direct.db.com/u/eb/Login_Main.serv*
- db-sg.db.com/*
- db-sg.db.com/gen/login/index_4.cfm*
- direct.capitecbank.co.za/*
- direct.capitecbank.co.za/ibank*
- direct.mcbgroup-ebanking.com/*
- direct.mcbgroup-ebanking.com/cmblogin/corporate_AuthenticateUserLocalEPF.html
- direct.mcbgroup-ebanking.com/mcbbonairelogin/corporate_AuthenticateUserLocalEPF.html*
- direct.mcbgroup-ebanking.com/mcblogin/corporate_AuthenticateUserLocalEPF.html
- direct.mcbgroup-ebanking.com/wiblogin/corporate_AuthenticateUserLocalEPF.html*
- direct.smbc.co.jp/*
- direct.smbc.co.jp/aib/aibgsjsw5001.jsp
- drob.santanderbank.com/*
- drob.santanderbank.com/cscobgss/Satellite*
- e-access.compassbank.com/*
- e-access.compassbank.com/bbw/cmserver/welcome/default/verify.cfm*
- e-bank.unicreditbank.si/*
- e-bank.unicreditbank.si/webbankBACX*
- e-bank.wuestenrot.de/*
- e-bank.wuestenrot.de/ebanking/eb/index.html
- e-bcr.bcr.ro/smartofficemobile/999XIT.lyo*
- e-biz.smbc.co.jp/*
- e-biz.smbc.co.jp/core/index.html
- e-cash.alrajhibank.com.my/*
- e-cash.alrajhibank.com.my/CashWebAlrajhi/index.jsp
- e-gbs24.gbsbarlinek.pl
- e-gbs24.gbsbarlinek.pl/*
- eadibcorp.adib.ae/*
- eadibcorp.adib.ae/cb/servlet/cb/jsp-ns/login.jsp*
- ebaer.juliusbaer.com/*
- ebank.bankbps.pl/*
- ebank.bankbps.pl/bpskatowice_k
- ebank.bankbps.pl/bpskrakow_k
- ebank.bankbps.pl/bpslublin_k
- ebank.bankbps.pl/bpsolsztyn_k
- ebank.bankbps.pl/bpsrzeszow_k
- ebank.bankbps.pl/bpswarszawa_k
- ebank.bankbps.pl/bpswroclaw_k
- ebank.garantibank.nl/*
- ebank.garantibank.nl/scripts/gbide.dll*
- ebank.publicbank.com.hk/*
- ebank.publicbank.com.hk/index0028.html
- ebank.turkishbank.co.uk/*
- ebank.turkishbank.co.uk/Default2.aspx*
- ebankas.danskebank.lt/*
- ebankas.danskebank.lt/ib/site/login*
- ebanking-au.ubs.com/*
- ebanking-au.ubs.com/ebanking*
- ebanking-aut.ubs.com/*
- ebanking-aut.ubs.com/epexa*
- ebanking-aut.ubs.com/estmta*
- ebanking-aut.ubs.com/fim*
- ebanking-bel.ubs.com/*
- ebanking-bel.ubs.com/epexb*
- ebanking-bel.ubs.com/estmtb*
- ebanking-bel.ubs.com/fim*
- ebanking-bhs2.ubs.com/*
- ebanking-bhs2.ubs.com/epex*
- ebanking-ca.ubs.com/*
- ebanking-ca.ubs.com/estmtc/action/login*
- ebanking-ca.ubs.com/gepc/MainAction*
- ebanking-ca.ubs.com/safeloginc/Login*
- ebanking-can.ubs.com/*
- ebanking-can.ubs.com/epex*
- ebanking-can.ubs.com/estmtc*
- ebanking-ch.ubs.com/*
- ebanking-ch.ubs.com/workbench/Index.do*
- ebanking-ch2.ubs.com/*
- ebanking-ch2.ubs.com/workbench/Index.do*
- ebanking-de1.ubs.com/*
- ebanking-de1.ubs.com/enquiries/controller/*
- ebanking-de1.ubs.com/workbench/Index.do*
- ebanking-es.ubs.com/
- ebanking-es.ubs.com/*
- ebanking-fr.ubs.com/*
- ebanking-fr.ubs.com/enquiries/*
- ebanking-hksg.ubs.com/
- ebanking-hksg.ubs.com/*
- ebanking-it.ubs.com/
- ebanking-it.ubs.com/*
- ebanking-lux.ubs.com/*
- ebanking-lux.ubs.com/epex*
- ebanking-lux.ubs.com/estmt*
- ebanking-lux.ubs.com/fim*
- ebanking-mc.ubs.com/
- ebanking-mc.ubs.com/*
- ebanking-nld.ubs.com/*
- ebanking-nld.ubs.com/estmtn*
- ebanking-uk.ubs.com/
- ebanking-uk.ubs.com/*
- ebanking.denizbank.at/*
- ebanking.denizbank.at/login.aspx
- ebanking.es.rbcis.com/*
- ebanking.es.rbcis.com/ebancoval/control/login
- ebanking.fransabank.com/*
- ebanking.fransabank.com/LoginAE.aspx
- ebanking.procreditbank-kos.com/*
- ebanking.procreditbank-kos.com/User/LogOn
- ebanking.societegenerale.al/*
- ebanking.societegenerale.al/webbankALB/loginCer.jsp*
- ebanking.societegenerale.in/*
- ebanking.societegenerale.in/corp/AuthenticationController*
- ebanking2.danskebank.co.uk/*
- ebanking2.danskebank.co.uk/pub/logon/logon.aspx*
- ec.synnex.com/ecexpress/login.html*
- ec.synnex.com/ecexpress/newWelcome.do
- ef3web.factorbank.com/*
- ef3web.factorbank.com/efweb/servlet/efweb.RCServlet
- elink.echodata.com/*asp
- elink.echodata.com/default.asp
- ematchingnz1.online.anz.com/*
- ematchingnz1.online.anz.com/saam/SAAMLogin/Login.fcc*
- enlace.santander-serfin.com/*
- enlace.santander-serfin.com/eai/EaiEmpresasWAR/inicio.do*
- enterprisecenter.verizon.com/
- entreprises.bnpparibas.net/*
- entreprises.bnpparibas.net/NSAccess
- entreprises.retraite.assurances.natixis.com
- entreprises.retraite.assurances.natixis.com/*
- entreprises.societegenerale.fr/
- entreprises.societegenerale.fr/*
- entreprises.societegenerale.fr/associations-connexion.html*
- entreprises.societegenerale.fr/index.html*
- epargnants.interepargne.natixis.fr/*
- epargnants.interepargne.natixis.fr/def_int_ep/ep/home.do*
- epayday.e-ambiz.com.my/*
- epayday.e-ambiz.com.my/epayroll/login.do
- eplusgiro.plusgirot.se/*
- eplusgiro.plusgirot.se/eplusgiro.html
- eplusgiro.plusgirot.se/eplusgiro_comp.html
- es-services.credit-suisse.com/*
- es-services.credit-suisse.com/cs/ibip/frontend/c/cls/auth
- esavings.shawbrook.co.uk/*
- esavings.shawbrook.co.uk/BankFast/Shawbrook*
- esecure.banque-edel.fr/*
- esecure.banque-edel.fr/es@b/fr/index.jsp
- eservice.cembra.ch
- eservice.cembra.ch/*
- esipub.esi-sa.com/*
- esipub.esi-sa.com/INGArchive/Account/Login.aspx*
- espace-client.cora.fr/*
- espace-client.cora.fr/FrHomeBK/cora/logon.do
- express.53.com/*
- express.53.com/portal/auth/login/Login*
- extra.unicreditbank.hu/*
- extra.unicreditbank.hu/eib_SP/loginpage.hu.html*
- extra.unicreditbank.hu/eibpublic_SP/login.de.html*
- extra.unicreditbank.hu/eibpublic_SP/login.en.html*
- extra.unicreditbank.hu/eibpublic_SP/login.hu.html*
- extranet.bpifrance.fr/*
- extranet.bpifrance.fr/etresosesame/connexion.do
- factor.bnpparibas.com/*
- factor.bnpparibas.com/factoring/fr/Portail_Connexion.or*
- factoring.mb.seb.se/*
- factoring.mb.seb.se/nauth3/Authentication/login.jsp*
- factoring.resurs.se/*
- factoring.resurs.se/login.aspx
- factoring.resurs.se:81/*
- factoring.resurs.se:81/login.aspx
- factoring.seb.de/*
- factoring.seb.de/nauth3/Authentication/login.jsp*
- fakturaservice.marginalen.se
- fakturaservice.marginalen.se/*
- fareastnationalbank.ebanking-services.com/*
- fareastnationalbank.ebanking-services.com/EamWeb/account/login.aspx*
- fastbanking.bancpost.ro/*
- fastbanking.bancpost.ro/iBankWeb/login.jsp*
- fastpay.asbbank.co.nz/*
- fastpay.asbbank.co.nz/Account/LogOn*
- fcp.efulfillmentservice.com/index.php*
- fdonline.co-operativebank.co.uk/*
- fdonline.co-operativebank.co.uk/corp/BANKAWAY*
- fes.rakuten-bank.co.jp/*
- fes.rakuten-bank.co.jp/MS/main/RbS*
- ffcw.webcashmgmt.com/*
- ffcw.webcashmgmt.com/wcmfd/wcmpw/CustomerLogin*
- financepilot-pe.mlp.de/*
- financepilot-pe.mlp.de/p12pepe/entry*
- finanzportal.fiducia.de/*
- finanzportal.fiducia.de/p01pebe/entry*
- finanzportal.fiducia.de/p13pepe/entry*
- fmw.ferbermidwest.com/cw/*
- fmw.ferbermidwest.com/fmw/*
- fnb.asb.co.nz/*
- fnb.asb.co.nz/SignOn.aspx
- foton-it.ubs.com/
- foton-it.ubs.com/*
- fps.fidelity.com/ftgw/Fps/Fidelity/RSAAnalyzeChallengeRetail/Maintain/Init
- fr-services.credit-suisse.com/*
- fr-services.credit-suisse.com/cs/ibip/frontend/c/cls/auth
- fx.regions.com/*
- fx.regions.com/esn01/servlet/RSASingleSignOn*
- fxpayments.americanexpress.com
- fxpayments.americanexpress.com/*
- gateway.citizenscommercialbanking.com/*
- gateway.citizenscommercialbanking.com/ccp/accessmoneymanager.jsp*
- gfs.nb.se/*
- gfs.nb.se/privat/bank/index_foretag.html
- gg-services.credit-suisse.com/*
- gg-services.credit-suisse.com/cs/ibip/frontend/c/cls/auth
- gi-services.credit-suisse.com/*
- gi-services.credit-suisse.com/cs/ibip/frontend/c/cls/auth*
- girolink.plusgirot.se/
- girolink.plusgirot.se/*
- girovision.plusgirot.se/
- girovision.plusgirot.se/*
- global.americanexpress.com/myca/intl/isummary/??/summary.do*
- global.kbstar.com/*
- global.kbstar.com/quics*
- globalpay.westernunion.com/*
- globalpay.westernunion.com/GlobalPay/Login.aspx*
- group.unicreditbanking.net/
- group.unicreditbanking.net/*
- hbciweb.olb.de/*
- hbciweb.olb.de/financebrowser5*
- here-online.gutmann.at/pobapp/LoginForm.aspx*
- hk-services.credit-suisse.com/*
- hk-services.credit-suisse.com/cs/ibip/frontend/c/cls/auth
- home?.cybusinessonline.co.uk/*
- home?.cybusinessonline.co.uk/lmgruV8/ceblm-web/login.ctl*
- home?.ybonline.co.uk/*
- home?.ybonline.co.uk/raluV8/reglm-web/login.ctl*
- homebank.tsbbank.co.nz/*
- homebank.tsbbank.co.nz/online*
- ht.businessonlinepayroll.com/*
- ht.businessonlinepayroll.com/SPF/login/ee_auth.aspx*
- https:/*
- https://*.websteronline.com/*
- https://arg3875.andbank.com/olywebAND/Authentication
- ib.absa.co.za/*
- ib.absa.co.za/absa-online/login.jsp
- ib.baltikums.eu/*
- ib.baltikums.eu/x/login;jsessionid=BB003BE9FD76AAB7C6C99F3D944F7152*
- ib.banksyd.com.au/
- ib.banksyd.com.au/*
- ib.bib.lv/*
- ib.bib.lv/web/guest;jsessionid=0125DB8D917675A75518DC10BDE4100F
- ib.btrl.ro/*
- ib.btrl.ro/BT24/bfo/channel/web/loginframe.jsp*
- ib.greater.com.au/*
- ib.greater.com.au/OnlineBanking/Login.aspx
- ib.mebank.com.au/*
- ib.mebank.com.au/auth/ib/login.html
- ib.swedbank.lv/*
- ib.swedbank.lv/business*
- ib.tmbank.com.au/*
- ib.tmbank.com.au/ib/SignOn/Login.aspx
- ib.tmbank.com.au/ib/signon/Login.aspx*
- ib3.bsp.com.pg/*
- ib3.bsp.com.pg/IB/businesslogin.aspx
- ibank.gtbankuk.com/*
- ibank.gtbankuk.com/Gaps_UK/Default.aspx*
- ibank.humebank.com.au/*
- ibank.humebank.com.au/mvp/signon/login.aspx
- ibank.reliancebankltd.com/*
- ibank.reliancebankltd.com/logon.aspx*
- ibank.sbs.net.nz/*
- ibank.sbs.net.nz/ui/inetbankindex.aspx
- ibank.standardchartered.com.sg/*
- ibank.standardchartered.com.sg/nfs/login.htm*
- ibank.theaccessbankukltd.co.uk/*
- ibank.theaccessbankukltd.co.uk/entry/CorpLoginLang.html*
- ibank.zenith-bank.co.uk/*
- ibank.zenith-bank.co.uk/internetbanking/index.jsp*
- ibank1.bib.barclays.com/*
- ibank1.bib.barclays.com/logon
- ibanking.bankofmelbourne.com.au/*
- ibanking.bankofmelbourne.com.au/ibank/loginPage.action
- ibb.firsttrustbank1.co.uk/*
- ibb.firsttrustbank1.co.uk/ibb/controller*
- ibbweb.tecmarket.it/*
- ibbweb.tecmarket.it/tmibbwebsecurity/05034/login.aspx*
- ibiznes24.pl/*
- ibiznes24.pl/bzwbk24biznes-client/login.html
- ibs.bankwest.com.au/*
- ibs.bankwest.com.au/BWLogin/bib.aspx*
- ibs.medbank.lt/*
- ibs.medbank.lt/login.aspx
- ideal.dbs.com/*
- ideal.dbs.com/loginSubscriber/login/pin.jsp*
- idsnet.teamidslogistics.com/wdlsweb*
- inba.lukb.ch/*
- inba.lukb.ch/lukbLogin/*
- inbursamf.inbursa.com/
- inbursamf.inbursa.com/*
- inetbnkp.adelaidebank.com.au/*
- inetbnkp.adelaidebank.com.au/OnlineBanking/AdBank*
- infinity.icicibank.co.uk/*
- infinity.icicibank.co.uk/UKRET/BANKAWAY*
- inloggad.volvofinans.se/*
- inloggad.volvofinans.se/foretag/inloggning/forenklad.html
- inloggad.volvofinans.se/privat/inloggning/valjInloggning.html
- internationalfx.bannerbank.com/*
- internationalfx.bannerbank.com/servlet/VTDController
- internet-banking.dbs.com.sg/*
- internet-banking.dbs.com.sg/IB/Welcome*
- internet.ocbc.com/*
- internet.ocbc.com/internet-banking*
- internetbanken.forex.se/*
- internetbanken.forex.se/wps/portal/0087
- internetbanken.privat.nordea.se/*
- internetbanken.privat.nordea.se/nsp/engine*
- internetbanken.privat.nordea.se/nsp/login
- internetbanken.sparbankenoresund.se/*
- internetbanken.sparbankenoresund.se/BankIDLogin/sidor/login.aspx
- internetbanking.firstcaribbeanbank.com/*
- internetbanking.firstcaribbeanbank.com/index.jsp
- internetbanking.imb.com.au/*
- internetbanking.imb.com.au/IB/personal
- internetbanking.scu.net.au/*
- internetbanking.scu.net.au/mvpscu/SignOn/Login.aspx
- internetbanking.suncorpbank.com.au/
- internetbanking.suncorpbank.com.au/*
- inventory.landiscowhse.com/
- invest.etrade.com.au/*
- invest.etrade.com.au/Home.aspx*
- it-services.credit-suisse.com/*
- it-services.credit-suisse.com/cs/ibip/frontend/c/cls/auth*
- jpmcsso-uk.jpmorgan.com/*
- jpmcsso-uk.jpmorgan.com/sso/action/federateLogin*
- jpmcsso.jpmorgan.com/*
- jpmcsso.jpmorgan.com/sso/action/federateLogin*
- jpmcsso.jpmorgan.com/sso/action/login*
- jpmorgan.chase.com/*
- jpmorgan.chase.com/Public/Logon
- jpmpb001.jpmorgan.com/*
- jpmpb001.jpmorgan.com/prelogin/index.jsp
- konto.baaderbank.de/*
- konto.biw-bank.de/*
- konto.biw-bank.de/onlinebanking-biwvp/login
- ktt.key.com/*
- ktt.key.com/ktt/cmd/logon*
- kultaraha.op.fi/*
- kultaraha.op.fi/cgi-bin/krcgi
- kunde.comdirect.de/*
- kunde.comdirect.de/lp/wt/login
- kunde.onvista-bank.de/*
- kunde.onvista-bank.de/login.html*
- kunden-mkb-bank.de
- kunden-mkb-bank.de/
- kunden-mkb-bank.de/*
- leadersystems.com.au/
- leadersystems.com.au/Account/Logon
- leumionline.bankleumi.co.uk/*
- leumionline.bankleumi.co.uk/my.policy*
- leumionline.leumiusa.com/*
- leumionline.leumiusa.com/uniquesiga2fb1806b2b3831412436dd67c0ba0085419e78b8eb462c3cbbdd1d547afe055/uniquesig0
- li.ironmountain.com/KeystoneSTS/Saml2/Login.aspx*
- live.barcap.com/*
- live.barcap.com/UAB/S/ecom/logon/1/barxcorporate*
- lloydslink.online.lloydsbank.com/*
- lloydslink.online.lloydsbank.com/Logon/Logon.jsp*
- login.24banking.ro/*
- login.24banking.ro/casserver/login*
- login.binck.nl
- login.binck.nl/*
- login.careerone.com.au/Login/SignIn*
- login.fidelity.com/ftgw/Fas/Fidelity/FIISCust/Login/Response
- login.fidelity.com/ftgw/Fas/Fidelity/RtlCust/Login/Init*
- login.fidelity.com/ftgw/Fas/Fidelity/RtlCust/Login/Response*
- login.fidelity.com/ftgw/Fas/Fidelity/RtlCust/Refresh/Init*
- login.fidelity.com/ftgw/Fidelity/NBPart/Login/Init
- login.isso.db.com/*
- login.isso.db.com/websso/sso_custom_multi_auth_flex_Logon.sso*
- login.isso.db.com/websso/sso_multi_auth_Logon.sso*
- login.salesforce.com/
- login.salesforce.com/*
- login.smartbusiness.ae/*
- login.smartbusiness.ae/bo-login.jsp*
- login.webgistix.com/
- login1.capitalone.com/loginweb/login/invalidCredential.do
- login1.capitalone.com/loginweb/login/login.do
- login1.capitalone.com/loginweb/login/loginMFA.do*
- logon.online.anz.com/*
- logon.online.anz.com/auth/Logon/CentralLogin.fcc*
- logon.reflex.rhbbank.com.my/*
- logon.reflex.rhbbank.com.my/rhbcams/corporate/login.jsp
- logon.rhb.com.my/
- logon.rhb.com.my/*
- lu-directnet.credit-suisse.com/*
- lu-directnet.credit-suisse.com/dn/c/cls/auth
- m.singlepoint.usbank.com/spt_mobile_web/sbb/logon*
- mblogin.verizonwireless.com/amserver/loginflow/main
- mblogin.verizonwireless.com/amserver/UI/Login
- mc-services.credit-suisse.com/*
- mc-services.credit-suisse.com/cs/ibip/frontend/c/cls/auth*
- mcbdirect.mcb-bank.com/*
- mcbdirect.mcb-bank.com/business/online*
- mcbdirect.mcbbonaire.com/*
- mcbdirect.mcbbonaire.com/business/online*
- mdcommercial.jpmorgan.com/
- mdcommercial.jpmorgan.com/*
- meine.deutsche-bank.de/*
- meine.deutsche-bank.de/trxm/db*
- meine.norisbank.de
- meine.norisbank.de/*
- meine.sutorbank.de
- meine.sutorbank.de/*
- mijn.asrbank.nl/*
- mijn.asrbank.nl/loginpagina.aspx*
- mijn.gilissen.nl/
- mijn.gilissen.nl/*
- mijn.ing.nl/
- mijn.ing.nl/*
- mijnzakelijk.ing.nl/
- mijnzakelijk.ing.nl/*
- mittval.maxm.se/*
- mittval.maxm.se/companyservices
- mnet.marginalen.se
- mnet.marginalen.se/*
- moj.multibank.pl/
- moj.multibank.pl/*
- monitor.kasbank.com/
- monitor.kasbank.com/*
- multiversa.geartesiabank.nl/*
- multiversa.geartesiabank.nl/MULTIVERSA-IFP/actions/login*
- my.banklenz.de/*
- my.banklenz.de/web/guest/login*
- my.fulfillrite.com/portal/Account/Login.aspx*
- my.hsbcprivatebank.com/*
- my.hsbcprivatebank.com/1/2/*
- my.hypovereinsbank.de/*
- my.hypovereinsbank.de/login*
- my.sjpbank.co.uk/*
- my.sjpbank.co.uk/Security/Auth/Logon*
- my.statestreet.com/
- my.statestreet.com/*
- my.statestreet.com/secid-smpwservices.fcc*
- myaccounts.newbury.co.uk/*
- myaccounts.newbury.co.uk/main.asp*
- mybbsaccounts.bucksbs.co.uk/*
- mybbsaccounts.bucksbs.co.uk/mlogn01.asp*
- mycardholderservicing.com/
- mycardholderservicing.com/[?]*
- mycardholderservicing.com/Login.do*
- mycardholderservicing.com/ProcessLogin.do*
- nab.directnet.com/*
- nab.directnet.com/dn/c/cls/auth
- nabconnect*.nab.com.au/*
- nabconnect*.nab.com.au/auth/nabclogin/login.do*
- nb.nordea.no/*
- nb.nordea.no/jlogin/nettbank/login/login
- nbnet.novobanco.es
- nbnet.novobanco.es/*
- nebasilicon.fdecs.com/*
- nebasilicon.fdecs.com/eCustService/*
- net.crediteurope.ro/*
- net.crediteurope.ro/ibank-cln/do/login/prompt*
- netaccess3.qtmb.com.au/*
- netaccess3.qtmb.com.au/QTMB/NetTeller/login.aspx
- netbanking.mashreqbank.com/*
- netbanking.mashreqbank.com/B001/SMELogin.jsp*
- netbanking.sparkasse.at
- netbanking.sparkasse.at/*
- netbanking.ubluk.com/*
- netbanking.ubluk.com/Login/Index*
- netredex.grupobbva.com/*
- netredex.grupobbva.com/local_tebe/TEBELogin_bbva_belgica_CAS.html
- netredex.grupobbva.com/local_tebe/TEBELogin_bbva_belgica_FRA.html
- netredex.grupobbva.com/local_tefr/TEFRLogin_bbva_francia_CAS.html
- netredex.grupobbva.com/local_tefr/TEFRLogin_bbva_francia_FRA.html
- netredex.grupobbva.com/local_teln/TELNLogin_bbva_londres_ING.html
- netredex.grupobbva.com/local_telnsp/TELNLogin_bbva_londres_CAS.html
- nettbank.danskebank.no/*
- nettbank.danskebank.no/html/index.html*
- nettbank.edb.com/*
- nettbank.edb.com/edbnettbank
- nettbank.edb.com/edbnettbankhttps:
- nettbank.remember.no
- nettbank.remember.no/*
- nettbank.seb.no/*
- nettbank.seb.no/authenticate/login/selectauth
- nettbanken.nordea.no/*
- nettbanken.nordea.no/login
- netteller2.tsw.com.au/*
- netteller2.tsw.com.au/delphi/ntv451.asp*
- netteller?.pnbank.com.au/*
- netteller?.pnbank.com.au/InternetBanking/Login.aspx*
- newentreprises.interepargne.natixis.com/
- newentreprises.interepargne.natixis.com/*
- newentreprises.interepargne.natixis.com/nie_psd_ee/EC_EE_TRANSV_AUTH_01.action*
- nge01.bnymellon.com/*
- nge01.bnymellon.com/NextGenV4/dflt/Login.ing
- nohasslerewards.capitalone.com/login.aspx
- nordic.carnegie.se
- nordic.carnegie.se/*
- ob.cua.com.au/*
- ob.cua.com.au/ib/f7bba4b88b84645e0ff8787e159be60d/LoginAuth.action
- obank.kbstar.com/*
- obank.kbstar.com/quics*
- oficinaempresas.bankia.es/*
- oficinaempresas.bankia.es/es/login.html
- oi.bankia.es/*
- oi.bankia.es/es/login
- oltx.fidelity.com/ftgw/fbc/ofaccounts/BrokerageBalances*
- oltx.fidelity.com/ftgw/fbc/ofpositions/snippet/portfolioPositions
- oltx.fidelity.com/ftgw/fbc/oftop/portfolio*
- oltx.fidelity.com/ftgw/fbc/oftop2/cashmgmtAllAcct?ACCOUNT=&CREDIT_CARD=
- oltx.fidelity.com/snapshoot/62
- onba.zkb.ch
- onba.zkb.ch/*
- onepass.regions.com/*
- onepass.regions.com/oaam_server/oamLoginPage.jsp*
- online-business.bankofscotland.co.uk/*
- online-business.bankofscotland.co.uk/business/logon/login.jsp*
- online-business.tsb.co.uk/*
- online-business.tsb.co.uk/business/logon/login.jsp
- online-private.unicredit.it/*
- online-private.unicredit.it/login.htm*
- online-retail.unicredit.it/*
- online-retail.unicredit.it/login.htm*
- online-smallbusiness.unicredit.it/*
- online-smallbusiness.unicredit.it/login.htm*
- online.adambank.com/*
- online.adambank.com/eBankingAdamLogin/login*
- online.akbank.de/*
- online.akbank.de/onlinebanking/de/Login.html
- online.alrayanbank.co.uk/*
- online.alrayanbank.co.uk/online/aspscripts/Logon.asp*
- online.americanexpress.com/myca/accountprofile/us/view.do?request_type=authreg_home&source=inav&sorted_index=0&inav=MYCA_PC_Profile_Preference2
- online.americanexpress.com/myca/accountsummary/??/accounthome*
- online.americanexpress.com/myca/acctmgmt/??/myaccountsummary.do*
- online.americanexpress.com/myca/logon/us/action/LogLogonHandler*
- online.americanexpress.com/myca/logon/us/action/LogonHandler*
- online.americanexpress.com/myca/tasdsgn/??/action*
- online.americanexpress.com/snapshoot/25
- online.arabbank.com.au/*
- online.arabbank.com.au/login/abaonline
- online.asb.co.nz/*
- online.asb.co.nz/auth/
- online.atbank.nl/*
- online.atbank.nl/atb-corporate/engine
- online.atbank.nl/atb-retail/engine
- online.bankaustria.at
- online.bankaustria.at/*
- online.bankmecu.com.au/*
- online.bankmecu.com.au/daib/logon/*/logon.asp*
- online.bankofcyprus.co.uk/*
- online.bankofcyprus.co.uk/netteller/login.faces*
- online.bankofscotland.co.uk/*
- online.bankofscotland.co.uk/personal/logon/login.jsp*
- online.bankvonroll.ch
- online.bankvonroll.ch/*
- online.bulbank.bg/*
- online.bulbank.bg/page/[?]*
- online.bulbank.bg/page/default.aspx
- online.bulbank.bg/page/default.aspx*
- online.carnegie.se/*
- online.carnegie.se/Login/Logon
- online.ccbank.co.uk/*
- online.ccbank.co.uk/main.asp*
- online.citi*.com/??/CBOL/ain/cardasboa/flow.action*
- online.citi*.com/??/CBOL/ain/dashboard/flow.action*
- online.citi*.com/??/JPS/portal/Home.do*
- online.citi*.com/??/JPS/portal/Index.do*
- online.citi*.com/??/JPS/portal/LocaleSwitch.do*
- online.citi*.com/??/JSO/signon/CBOLSessionRecovery.do
- online.citi*.com/??/JSO/signon/LocaleUsernameSignon.do*
- online.citi*.com/??/JSO/signon/uname/HomePageCinless.do*
- online.citi*.com/??/JSO/signon/uname/Next.do*
- online.citi*.com/??/JSO/signon/VIPLocaleUsernameSignon.do*
- online.citi*.com/US/JRS/contactinfo/initialiseContactInfo.do*
- online.citi.eu/*
- online.citi.eu/GBIPB/JSO/signon/DisplayUsernameSignon.do*
- online.citi/snapshoot/3
- online.corp.westpac.co.nz/
- online.corp.westpac.co.nz/*
- online.corp.westpac.com.au/
- online.corp.westpac.com.au/*
- online.coutts.com/*
- online.coutts.com/eBankingCouttsLogin/login*
- online.crfossano.it/*
- online.crfossano.it/nb/it/index.html*
- online.dib.ae/*
- online.dib.ae/webapplication.ui/localoperations/login/loginpage.aspx*
- online.duncanlawrie.com/*
- online.duncanlawrie.com/InternetBanking/faces/mdi/login.jsp*
- online.ebs.ie/*
- online.ebs.ie/internet/login/index.jsp*
- online.gutmann.at/*
- online.hapoalimusa.com/*
- online.hapoalimusa.com/BHCorporate/core/login.aspx
- online.hbs.net.au/*
- online.hbs.net.au/hbsv47/ntv471.asp*
- online.hl.co.uk/*
- online.hl.co.uk/my-accounts*
- online.hoaresbank.co.uk/*
- online.hoaresbank.co.uk/fi11512/bb/logon*
- online.kbc.ie/*
- online.kbc.ie/kbc-online/onlinebanking/login*
- online.lloydsbank.co.uk/*
- online.lloydsbank.co.uk/personal/logon/login.jsp*
- online.mbank.pl/*
- online.mbank.pl/pl/Login
- online.multiport.com.au/
- online.multiport.com.au/*
- online.mystate.com.au/*
- online.mystate.com.au/Banking/Business
- online.mystate.com.au/Banking/Personal
- online.nbad.com/*
- online.nbad.com/iportalweb/iportal/jsps/orbilogin.jsp*
- online.popularbancaprivada.es/*
- online.popularbancaprivada.es/index.html
- online.privatebanking.societegenerale.be/*
- online.privatebanking.societegenerale.be/sg/login_fr.html*
- online.privatebanking.societegenerale.be/sg/login_nl.html*
- online.s-pankki.fi/*
- online.s-pankki.fi/service/identify
- online.tsb.co.uk/personal/logon/login.jsp*
- online.unicreditcorporate.it/*
- online.unicreditcorporate.it/login.htm*
- online.wellsfargo.com/das/cgi-bin/session.cgi?screenid=SIGNON_PORTAL_PAUSE
- online.wellsfargo.com/das/channel/accountSummary*
- online.wellsfargo.com/das/signon*
- online.wellsfargo.com/login*
- online.wellsfargo.com/signon*
- online.westpac.com.au/*
- online.westpac.com.au/esis/Login/SrvPage*
- online.ybs.co.uk/*
- online.ybs.co.uk/public/authentication/login1.do*
- onlinebanking-sg.credit-suisse.com/
- onlinebanking-sg.credit-suisse.com/*
- onlinebanking.bankcoop.ch/
- onlinebanking.bankcoop.ch/*
- onlinebanking.bankcoop.ch/coopLogin
- onlinebanking.coutts.com/*
- onlinebanking.coutts.com/auth/login
- onlinebanking.nationwide.co.uk/AccessManagement/Login
- onlinebanking.nationwide.co.uk/AccountList
- onlinebanking.nationwide.co.uk/CustomerIB/ViewAndMaintainCustomerDetails/Index
- onlinebanking.orcobank.com/*
- onlinebanking.orcobank.com/orcobankonline/
- onlinebanking.usbank.com/Auth/Login
- onlinebanking.usbank.com/Auth/Login/Login
- onlinebanking.usbank.com/Auth/Login/StepUpCheck
- onlinebusiness.lloydsbank.co.uk/*
- onlinebusiness.lloydsbank.co.uk/business/logon/login.jsp*
- onlinebusinessplus.vancity.com/*
- onlinebusinessplus.vancity.com/business/default.jsp*
- onlineservices.ubs.com/*
- onlineservices.ubs.com/olsauth/ex/pbl/ubso/dl*
- otf.seb.se
- otf.seb.se/*
- pankki.tapiola.fi/*
- pankki.tapiola.fi/service/identify
- particuliers.societegenerale.fr/
- particuliers.societegenerale.fr/*
- pbusa.directnet.com/*
- pbusa.directnet.com/dn/c/cls/auth
- personal.co-operativebank.co.uk/*
- personal.co-operativebank.co.uk/CBIBSWeb/start.do*
- personal.gironet.com/*
- personal.gironet.com/DIBS_GIRO_BANK/pages/loginP.jsp
- personeo.epargne-retraite-entreprises.bnpparibas.com/*
- personeo.epargne-retraite-entreprises.bnpparibas.com/portal/salarie-bnp/*
- pfo.us.hsbc.com/
- pfo.us.hsbc.com/*
- portal.berenberg.de/*
- portal.berenberg.de/MULTIVERSA-IFP/faces/login/login.jsf*
- portal.northonline.com.au/*
- portal.northonline.com.au/WealthNET.PortalClient*
- portal.northonline.com.au/WealthNET.PortalClient/DUBLE
- portal.sutorbank.de
- portal.sutorbank.de/*
- portal4.sydbank.dk/*
- portal4.sydbank.dk/wps/bankdata/jsp/html/da/PortalFrame.jsp*
- portale.bancacaripe.it/*
- portale.bancacaripe.it/AreaRiservata.aspx*
- portale.tercas.it/*
- portale.tercas.it/AreaRiservata.aspx*
- portfolioservice.seb.fi/*
- portfolioservice.seb.fi/pbfi/Default.aspx*
- privat.bhf-bank.ch/*
- privat.bhf-bank.ch/Authentification/GetAuthentificationVersion*
- private.bankofsingapore.com/*
- private.bankofsingapore.com/Login/Login*
- private.lombardodier.com/*
- private.lombardodier.com/login/login.jsp
- privatebank-us.ubs.com/
- privatebank-us.ubs.com/*
- pro.skb.net/
- pro.skb.net/*
- pro.skb.net/MOI/moigw.dll/CMOI
- pro.skb.net/prijava/
- probank.tsbbank.co.nz/*
- probank.tsbbank.co.nz/ProBank/login.action
- probanking.procreditbank.ba/*
- probanking.procreditbank.ba/User/LogOn*
- professionnels.societegenerale.fr/*
- professionnels.societegenerale.fr/association_connexion.html*
- professionnels.societegenerale.fr/index.html*
- profnet2.tgservices.nl/
- profnet2.tgservices.nl/*
- qnet.e-quantum2k.com/~accent/cgi-bin/entry.cgi
- quotes-global1.ubs.com/*
- quotes-global1.ubs.com/go/*
- rakbankonline.ae/*
- rakbankonline.ae/corp/BANKAWAY*
- retail.santander.co.uk/*
- retail.santander.co.uk/EBAN_Accounts_ENS/channel.ssobto*
- retail.santander.co.uk/EBAN_ServiceRequest_ENS/BtoChannelDriver.ssobto?dse_encryptData=*&dse_operationName=ChangeContactDetails
- retail.santander.co.uk/LOGSUK_NS_ENS/BtoChannelDriver.ssobto*
- retail.santander.co.uk/LOGSUK_NS_ENS/ChannelDriver.ssobto*
- rib.affinonline.com/*
- rib.affinonline.com/rib/pb/logon
- ribs.rabobank.co.nz/*
- ribs.rabobank.co.nz/RIBSNZ/NZ
- ribs.rabobank.com.au/*
- ribs.rabobank.com.au/RIBSAU/AU
- rkiluelzxkqjrgbt54481.com
- ro.unicreditbanking.net/*
- ro.unicreditbanking.net/disp*
- rolb.santanderbank.com/FORPAS_ENS/ChannelDriver.bto*
- rolb.santanderbank.com/LOGSVG_NS_ENS/BtoChannelDriver.ssobto*
- rolb.santanderbank.com/LOGSVG_NS_ENS/ChannelDriver.ssobto*
- s2b.standardchartered.com/*
- s2b.standardchartered.com/ssoapp/login.jsp*
- santander.hpdsc.com/*
- santander.hpdsc.com/main*
- scs.fidelity.com/accounts/services/content/norelationship.shtml*
- sec.westpac.co.nz/*
- sec.westpac.co.nz/IOLB/Login.jsp
- secure*.store.apple.com/us/sign_in*
- secure-wms.com/PresentationTier/LoginForm.aspx*
- secure.aerofulfillment.com/efulfillment/login.aspx*
- secure.aldermorebusinesssavings.co.uk/*
- secure.aldermorebusinesssavings.co.uk/corporate*
- secure.ampbanking.com/*
- secure.ampbanking.com/au/Logon*
- secure.anz.co.nz/*
- secure.anz.co.nz/IBCS/service/login*
- secure.bankofamerica.com/customer/manageContacts/view-profile.go*
- secure.bankofamerica.com/login/languageToggle.go*
- secure.bankofamerica.com/login/sign-in/displayAuthCodeScreen.go*
- secure.bankofamerica.com/login/sign-in/entry/signOn.go*
- secure.bankofamerica.com/login/sign-in/entry/signOnV2.go*
- secure.bankofamerica.com/login/sign-in/internal/entry/signOn.go*
- secure.bankofamerica.com/login/sign-in/internal/entry/signOnV2.go*
- secure.bankofamerica.com/login/sign-in/signOn.go*
- secure.bankofamerica.com/login/sign-in/signOnScreen.go*
- secure.bankofamerica.com/login/sign-in/signOnV2Screen.go*
- secure.bankofamerica.com/login/sign-in/validateChallengeAnswer.go*
- secure.bankofamerica.com/myaccounts/signin/signIn.go*
- secure.bankofamerica.com/snapshoot/2
- secure.bankofscotland.co.uk/personal/a/account_overview_personal/
- secure.bankofscotland.co.uk/personal/a/your_personal_details/
- secure.boqspecialist.com.au/*
- secure.boqspecialist.com.au/BOQ/BOQSpecialist
- secure.capitalone360.com/myaccount/banking/login.vm
- secure.capitalone360.com/myaccount/banking/security_questions.vm
- secure.defencebank.com.au/*
- secure.defencebank.com.au/daib/logon/*/logon.asp*
- secure.ekobanken.se/*
- secure.ekobanken.se/security/login.aspx*
- secure.fiabusinesscard.com/login/transsignin/entry/signOnScreen.go*
- secure.fiacardservices.com/login/trans/cc/sign-in/entry/signOnScreen.go*
- secure.funds.lloydsbank.com/*
- secure.funds.lloydsbank.com/user/logon.aspx*
- secure.halifax-online.co.uk/personal/a/account_overview_personal/
- secure.halifax-online.co.uk/personal/a/your_personal_details/
- secure.hancockbank.com/online/Hancock/business/login.asp*
- secure.hancockbank.com/online/Hancock/Consumer/login.asp*
- secure.heartland.co.nz/*
- secure.heartland.co.nz/IB/index.zul*
- secure.ideabank.pl
- secure.ideabank.pl/*
- secure.ingdirect.fr/*
- secure.ingdirect.fr/public/displayLogin.jsf
- secure.ingdirect.it/*
- secure.ingdirect.it/login.aspx
- secure.internetbanking.firstcaribbeanbank.com/
- secure.internetbanking.firstcaribbeanbank.com/*
- secure.internetbanking.ro/*
- secure.internetbanking.ro/IBK_SMS/Login/LoginFirstStep.aspx*
- secure.lloydsbank.co.uk/personal/a/account_overview_personal/
- secure.lloydsbank.co.uk/personal/a/your_personal_details/
- secure.macquarie.com.au/*
- secure.macquarie.com.au/sepas/serve*
- secure.membersaccounts.com/*
- secure.membersaccounts.com/SELFSERVICE/login.aspx*
- secure.moneyou.de/*
- secure.moneyou.de/thc/policyenforcer/pages/loginB2C.jsf
- secure.provinet.net/*
- secure.provinet.net/cgi-bin.cgi/bbvanettxtencr.cgi*
- secure.resurs.se/*
- secure.resurs.se/butiksredovisning/login.do
- secure.resurs.se/butiksredovisning/setlang.do*
- secure.resurs.se/internetbank/inlaninglogin_foretag.jsp
- secure.skandiabanken.no/*
- secure.skandiabanken.no/Authentication/BankIdMobile
- secure.skandiabanken.no/Authentication/BankIdWebClient
- secure.skandiabanken.no/Authentication/OtpCodeCard
- secure.skandiabanken.no/Authentication/OtpSms
- secure.tddirectinvesting.co.uk/*
- secure.tddirectinvesting.co.uk/webbroker2/login.jsp*
- secure.tsb.co.uk/personal/a/account_overview_personal/
- secure.tsb.co.uk/personal/a/your_personal_details/
- secure.unicreditbank.lu/
- secure.unicreditbank.lu/*
- secure1.businesswaybnl.it/*
- secure1.businesswaybnl.it/newcorporate/webcontoc/login/login*
- secure1.entreprises.bnpparibas.net/*
- secure1.entreprises.bnpparibas.net/sommaire/jsp/identification.jsp
- secure1.rabodirect.co.nz/*
- secure1.rabodirect.co.nz/exp/policyenforcer/pages/loginB2CDGPEN.jsf*
- secure2.alphabank.ro/*
- secure2.alphabank.ro/corporate/CorpOTPLoginLangRom.jsp*
- securebank.santander.de/*
- securebank.santander.de/LICCMG_SCB_ENS/BtoChannelDriver.ssobto*
- securebanking.ally.com/
- securebanking.hanseaticbank.de/*
- securebanking.hanseaticbank.de/onlinebanking-hb/loginFormAction.do
- securentrycorp.amegybank.com/
- securentrycorp.amegybank.com/*
- securentrycorp.calbanktrust.com/
- securentrycorp.calbanktrust.com/*
- securentrycorp.nsbank.com/
- securentrycorp.nsbank.com/*
- securentrycorp.zionsbank.com/
- securentrycorp.zionsbank.com/*
- secureprivateebanking.nordea.ch/*
- secureprivateebanking.nordea.ch/ESERVICES/Login.aspx*
- secureprivateebanking.nordea.lu/*
- secureprivateebanking.nordea.lu/eServices/Login.aspx*
- secureprivateebanking.nordea.sg/*
- secureprivateebanking.nordea.sg/eServices/Login.aspx*
- securitiesexpert.credit-suisse.com/*
- securitiesexpert.credit-suisse.com/cs/eamnet/c/cls/auth
- see.sbi.com.mx/*
- see.sbi.com.mx/invernet2000/home*
- sendgrid.com/login
- server*.cey-ebanking.com/CLKPCB/*/login.asp*
- sg.bibplus.uobgroup.com/*
- sg.bibplus.uobgroup.com/BIB/public*
- sgcib.pl/*
- sgcib.pl/ib/Default.aspx*
- sharinbox.societegenerale.com/*
- sharinbox.societegenerale.com/login.do
- si.unicreditbanking.net/*
- si.unicreditbanking.net/disp*
- sikanet.sg-ssb.com.gh/*
- sikanet.sg-ssb.com.gh/priv/en/dciweb.htm*
- sikanet.sg-ssb.com.gh/priv/fr/dciweb.htm*
- singlepoint.usbank.com/*
- singlepoint.usbank.com/cs70_banking/logon/sbuser*
- sites.scotiabank.com.mx/*
- sites.scotiabank.com.mx/colproveedores/menu/entrada.asp*
- smartcard.kasbank.com/*
- smartcard.kasbank.com/kasweb/
- smb.att.com/olam/loginAction.olamexecute*
- sobanet.baloise.ch/*
- sobanet.baloise.ch/ibfLogin/*
- sogecashnet.sga.dz/*
- sogecashnet.sga.dz/smartoffice*
- sogecashnet.sgeb.bg/smartoffice/
- sogecashnet.societegenerale.cg/*
- sogecashnet.societegenerale.cg/smartoffice/GB*
- sogecashnet.societegenerale.cg/smartoffice/index.htm*
- sogeonline.societegenerale.cn/*
- sogeonline.societegenerale.cn/eweb/prelogin.do*
- solo.nordea.com/*
- solo.nordea.com/nsc/engine*
- solo1.nordea.fi/*
- solo1.nordea.fi/nsp/engine
- solo1.nordea.fi/nsp/login
- solo3.nordea.fi/*
- solo3.nordea.fi/cgi-bin/SOLO0001*
- sparen.nibcdirect.nl
- sparen.nibcdirect.nl/*
- speedorder.speedfc.com/admin/
- spib.wooribank.com/*
- spib.wooribank.com/pib/Dream*
- sponsor.voya.com/*
- sponsor.voya.com/static/sponsor/SponsorLogin.fcc
- ssl.icoio.de/*
- ssl.icoio.de/account
- ssl.icoio.de/cash
- ssl.icoio.de/realestate
- ssl2.haspa.de/*
- ssl2.haspa.de/OnlineFiliale/banking/authenticate/login
- sslsecure.maybank.com.sg/*
- sslsecure.maybank.com.sg/cgi-bin/mbs/scripts/mbb_login.jsp
- sso.cloud.ideabank.pl/*
- sso.cloud.ideabank.pl/login*
- sso.verizonenterprise.com/amserver/sso/login.go*
- ssologin-bp2s.bnpparibas.com/*
- ssologin.bnpparibas.com/*
- ssologin.bnpparibas.com/cib/LoginForm.aspx*
- start.ingbusinessonline.pl/*
- start.ingbusinessonline.pl/ing/do/sms
- subastas.scotiainlatrade.com/*
- subastas.scotiainlatrade.com/SubastasAppWeb/login.jsp
- swedbank.telehansa.net/*
- swedbank.telehansa.net/thnetfi/thnetfi
- tb.raiffeisendirect.ch/
- tb.raiffeisendirect.ch/*
- tdetreasury.tdbank.com/*
- tdetreasury.tdbank.com/s1gcb/logon/sbuser*
- tdwealth.netxinvestor.com/*
- tdwealth.netxinvestor.com/web/tdwealth/login
- telemarch.bancamarch.es/*
- telemarch.bancamarch.es/htmlVersion/index.jsp
- tesoreria.cabel.it/
- tesoreria.cabel.it/*
- tesoreriaonline.bper.it/*
- tesoreriaonline.bper.it/tesoreria/index.jsp
- ticari.yapikredi.com.tr/*
- ticari.yapikredi.com.tr/ifcapp/xrl/*
- token.kasbank.com/
- token.kasbank.com/*
- top.capitalonebank.com/*
- top.capitalonebank.com/cashplus/*
- top.capitalonebank.com/pub/html/login.html*
- transactgateway.svb.com/*
- transactgateway.svb.com/siliconvalley/customerlogin.aspx
- transtasman.online.anz.com/*
- transtasman.online.anz.com/client*
- trz.tranzact.org/*
- trz.tranzact.org/LogonOTP.aspx*
- u-2-view.chorleybs.co.uk/*
- u-2-view.chorleybs.co.uk/mlogn01.asp*
- ufo.union-investment.de/*
- ufo.union-investment.de/process*
- uk.hkbea-cyberbanking.com/*
- uk.hkbea-cyberbanking.com/UCBCorp/Index.action
- uk.hkbea-cyberbanking.com/UCBWeb/Index.action
- uksecure.barclayswealth.com/
- uksecure.barclayswealth.com/*
- uksecure.barclayswealth.com/UAB/S/bwl_logon*
- unified-access.societegenerale.com/*
- unified-access.societegenerale.com/portal/site/SogecashWeb*
- uniservices2.uobgroup.com/*
- uniservices2.uobgroup.com/ELO/login.jsp*
- us-new.ingrammicro.com/_layouts/CommerceServer/IM/Login.aspx*
- ve1.provinet.net/*
- ve1.provinet.net/nhvp_ve_web/atpn_es_web_jsp/login.jsp*
- velocity.ocbc.com/*
- velocity.ocbc.com/login.html
- velocity.ocbc.com/portal.view*
- verkkopankki2.danskebank.fi/*
- verkkopankki2.danskebank.fi/pub/logon/logon.aspx*
- vip.valartis.at/*
- vip.valartis.at/Pages/Login/Login.aspx
- wdlsslc.idsfulfillment.com/wdlsweb*
- wealth.goldman.com/*
- wealth.goldman.com/login/login_a.cgi*
- wealthclient.closebrothers.com/*
- wealthclient.closebrothers.com/Login*
- web.nfsrv.com/nfsportal/login*
- web.procapital.fr/*
- web.procapital.fr/bami/public/form_login.html
- web.procapital.fr/bami/public/form_procap_login.html
- webapp.sebgroup.com/*
- webapp.sebgroup.com/sec/extranet/inloggning/inloggning.asp*
- webbanking.bgl.lu/*
- webbanking.bgl.lu/de/Main.html
- webbanking.bgl.lu/en/Main.html
- webbanking.bgl.lu/fr/Main.html
- webbanking.bgl.lu/nl/Main.html
- webbanking.bgl.lu/pt/Main.html
- webcmpr.bancopopular.com/*
- webcmpr.bancopopular.com/K1*
- webzr.aktivbank.de/*
- webzr.aktivbank.de/webzr/login/ShowLogin.do
- wellsoffice.wellsfargo.com/*
- wellsoffice.wellsfargo.com/*/signon/index.jsp*
- wertpapier.hafnerbank.de
- wertpapier.hafnerbank.de/*
- wibdirect.wib-bank.net/*
- wibdirect.wib-bank.net/business/online*
- wireless.att.com/business
- wireless.att.com/business/index.jsp*
- workbench.bnymellon.com/*
- workbench.bnymellon.com/login.jsp*
- workplaceservices200.fidelity.com/mybenefits/navstation/navigation
- www.365online.com/*
- www.365online.com/online365/spring/authentication*
- www.accessonline.abnamro.com/*
- www.accessonline.abnamro.com/fss/open/welcome.do*
- www.accountonline.citi*.com/cards/svc/LoginIntNext.do*
- www.alliancebizsmart.com.my/*
- www.alliancebizsmart.com.my/business
- www.americanexpress.com/
- www.americanexpress.com/[?]*
- www.anyware.com.au/customer/account/login/*
- www.anz.com/*
- www.anz.com/INETBANK/bankmain.asp*
- www.anz.com/INETBANK/login.asp*
- www.anz.com/personal/
- www.anzdirect.co.nz/*
- www.anzdirect.co.nz/online/EnterANZDirect.do*
- www.anztransactive.anz.com/
- www.anztransactive.anz.com/*
- www.arabi-online.net/*
- www.arabi-online.net/efs/servlet/efs/jsp-ns/login.jsp*
- www.asb.co.nz/
- www.asb.co.nz/*
- www.asbolb.com/*
- www.asbolb.com/servlet/ASB.ASBServlet*
- www.asl.com/*
- www.asl.com/asl/login/entryFrame.jsp*
- www.asl.com/c/portal/login
- www.asnbank.nl/*
- www.asnbank.nl/onlinebankieren/secure/loginparticulier.html
- www.attijarioffshore.com/
- www.attijarioffshore.com/*
- www.baaderbank.de/*
- www.baaderbank.de/en/login.html
- www.badgergraphics.com/
- www.badgergraphics.com/about-us
- www.badgergraphics.com/blog
- www.badgergraphics.com/commercial-digital-print
- www.badgergraphics.com/contact-us
- www.badgergraphics.com/corporate-apparel
- www.badgergraphics.com/creative-design
- www.badgergraphics.com/direct-mail
- www.badgergraphics.com/e-commerce
- www.badgergraphics.com/on-demand-orders
- www.badgergraphics.com/promotional-products
- www.badgergraphics.com/signage
- www.badgergraphics.com/warehousing-fulfillment
- www.bami.lmpatrimonline.com/*
- www.bami.lmpatrimonline.com/bol-sb-web/EC01Action.do
- www.bami.lmpatrimonline.com/bol-sb-web/EP01Action.do
- www.bamibanque.fr/*
- www.bamibanque.fr/WD110AWP/WD110awp.exe/CONNECT/GESCOMPTE2010
- www.bancacrasti.it/*
- www.bancacrasti.it/sito2001/botw/botw_4-5/areavetrina2.asp
- www.bancacrasti.it/sito2001/botw/botw_4-5/areavetrina3.asp
- www.bancacrasti.it/sito2001/botw/botw_4-5/areavetrina4.asp
- www.bancaempresarialazteca.com.mx/*
- www.bancaempresarialazteca.com.mx/BancaEmpresarial/login.htm*
- www.bancoinbursa.com/*
- www.bancoinbursa.com/login/useraccessPortatil.asp
- www.bancomernetcash.com/*
- www.bancomernetcash.com/local_pibee/KDPOSolicitarCredenciales_es.html
- www.bancorpsouthinview.web-cashplus.com/*
- www.bancorpsouthinview.web-cashplus.com/Cashplus/
- www.bancorpsouthonline.com/*
- www.bancorpsouthonline.com/BXS/Login.aspx
- www.bankdirect.co.nz/
- www.bankdirect.co.nz/*
- www.bankhaus-lampe.de/*
- www.bankhaus-lampe.de/en/client-portal
- www.banking.axa.de/*
- www.banking.axa.de/OnlineBankingWebfrontend/banking/common/login.xhtml*
- www.bankline.natwest.com/*
- www.bankline.natwest.com/CWSLogon/logon.do*
- www.bankline.rbs.com/*
- www.bankline.rbs.com/CWSLogon/logon.do*
- www.bankline.ulsterbank.*/*
- www.bankline.ulsterbank.*/CWSLogon/logon.do*
- www.banknorwegian.no/*
- www.banknorwegian.no/Login/BankId
- www.banknorwegian.no/Login/BankIdMobil
- www.bankofamerica.com/
- www.bankofamerica.com/#login/sign-in/entry/signOn.go
- www.bankofamerica.com/[?]*
- www.bankofamerica.com/homepage/overview.go*
- www.bankofamerica.com/login/sign-in/entry/signOn.go*
- www.bankofamerica.com/onlinebanking/online-banking.go*
- www.bankofamerica.com/sitemap/hub/signin.go*
- www.bankofamerica.com/smallbusiness/
- www.bankunitedbusinessonlinebanking.com/*
- www.bankunitedbusinessonlinebanking.com/bbw/cmserver/welcome/default/verify.cfm*
- www.banorte.com/*
- www.banorte.com/portal/personas/acceso.web*
- www.banque-tahiti.pf/*
- www.banque-tahiti.pf/pauth.aspx*
- www.barclayswealth.ch/*
- www.barclayswealth.ch/Login/fedsso.do*
- www.barclayswealth.com/*
- www.barclayswealth.com/login/action/logon/unauthenticated/corporate/loginSigningGemplus
- www.barclayswealth.com/login/action/logon/unauthenticated/corporate/loginSigningGemplus*
- www.barclayswealth.com/login/action/logon/unauthenticated/personal/loginDetailsRouting
- www.barclayswealth.com/login/action/logon/unauthenticated/personal/loginDetailsRouting*
- www.barclayswealth.com/login/action/logon/unauthenticated/personal/loginRouting
- www.barclayswealth.mc/Login/fedsso.do*
- www.bbtcreditcardconnection.com/
- www.bbtcreditcardconnection.com/[?]*
- www.bbtcreditcardconnection.com/Login.aspx*
- www.bbtcreditcardconnection.com/MFAUnrecognized.aspx*
- www.bbvanet.cl/*
- www.bbvanet.cl/bbvanet/personas.html
- www.bbvanet.cl/bbvanet/Process*
- www.bbvanet.com.co/*
- www.bbvanet.com.co/index.html*
- www.bbvanetcash.cl/*
- www.bbvanetcash.cl/local_pibee/indexPibee.html
- www.bbvanetcash.com.co/*
- www.bbvanetcash.com.co/local_pibee/KDPOSolicitarCredenciales_es.html
- www.bbvanetcash.com/*
- www.bbvanetcash.com/local_kyop/KYOPSolicitarCredenciales.html
- www.bcif.fr/*
- www.bcif.fr/Compte/Login.aspx
- www.bcv.ch/*
- www.bcv.ch/bcvd-login/authenticateAction.do*
- www.bcv.ch/de
- www.bcv.ch/en
- www.bcv.ch/fr
- www.bendigobank.com.au/*
- www.bendigobank.com.au/banking/BBLIBanking*
- www.benefitaccess.com/*
- www.benefitaccess.com/cba.html
- www.biverbanca.it/*
- www.biverbanca.it/sito2001/botw/botw_4-5/areavetrina2.asp
- www.biverbanca.it/sito2001/botw/botw_4-5/areavetrina3.asp
- www.biverbanca.it/sito2001/botw/botw_4-5/areavetrina4.asp
- www.bizchannel.cimb.com.sg/*
- www.bizchannel.cimb.com.sg/corp/common2/login.do*
- www.bizsol.anser.ne.jp/*
- www.bizsol.anser.ne.jp/0010c/rblgi01/I1RBLGI01-S01.do
- www.bluechipit.com.au/
- www.bluechipit.com.au/customer/account/login/*
- www.bluepoint.net/users/login.php
- www.bmedonline.es/*
- www.bngbank.nl/*
- www.bngbank.nl/_layouts/15/Authenticate.aspx*
- www.bnpparibasfortis.be/*
- www.bnpparibasfortis.be/private/Start.asp
- www.bnz.co.nz/*
- www.bnz.co.nz/ib4b/app/login*
- www.bohcreditcard.com/servicing/
- www.bohcreditcard.com/servicing/[?]*
- www.bohcreditcard.com/servicing/login*
- www.boi-bol.com/*
- www.boi-bol.com/newHome.jsp
- www.boi-bol.com/newHome.jsp*
- www.bostonprivate.com/*
- www.bostonprivate.com/index.cfm/page/Online-Banking/pid/10540*
- www.bostonprivatebank.com/*
- www.bostonprivatebank.com/index.cfm/pid/10540*
- www.bpmbanking.it/*
- www.bpmbanking.it/pub/xbank/home.do
- www.brdoffice.ro/*
- www.brdoffice.ro/smartoffice/_mcologon*
- www.bsfincomonline.com/
- www.bsfincomonline.com/*
- www.btp.bdsonline.nl/*
- www.btp.bdsonline.nl/treasury
- www.btv.bdsonline.nl
- www.btv.bdsonline.nl/*
- www.business.hsbc.co.uk/*
- www.business.hsbc.co.uk/1/2/!ut/p/c5/04_SB8K8xLLM9MSSzPy8xBz9CP0os3gDgzAfSycDUy8LAzNDbz8vbzMDKADKR2LKuyHkgbotDB1dDZyDDTwMzM0sDTy93B1dnXz8DN0tTCC6nd0dPUzMfYCqwzxdDTxNnEwMTH3dDA08jQnoLsgNDQUAO-nOhw!!/*
- www.businessdirect.att.com/portal/*
- www.businessdirect.att.com/portal/smallbusiness/index.jsp*
- www.bybloseuropeonline.com/*
- www.bybloseuropeonline.com/finsebanking_enu_europe
- www.byblosonline.com/*
- www.byblosonline.com/finsebanking_enu
- www.capacityllc.com/
- www.capacityllc.com/*html
- www.capitalone.com/
- www.capitalonecardservice.ca/ecare/accountoverview*
- www.capitalonecardservice.ca/ecare/loginform*
- www.capitaloneonline.co.uk/CapitalOne_Consumer/Login.do
- www.cardservicesdirect.com.au/*
- www.cardservicesdirect.com.au/AUCRD/JSO/signon/DisplayUsernameSignon.do
- www.careerbuilder.co.in/jobposter/accounts/accountinfo.aspx*
- www.careerbuilder.co.in/jobposter/mycb.aspx
- www.careerbuilder.co.in/share/login.aspx*
- www.careerbuilder.co.in/snapshoot/23
- www.careerbuilder.com/jobposter/accounts/accountinfo.aspx*
- www.careerbuilder.com/jobposter/mycb.aspx
- www.careerbuilder.com/share/login.aspx*
- www.carife.it/*
- www.carife.it/it/accesso-imprese-online.php
- www.carife.it/it/accesso-imprese.php
- www.carife.it/it/accesso-privati.php
- www.casden.fr/*
- www.casden.fr/simu/view/accueil.seam
- www.cashanalyzer.com/
- www.cashanalyzer.com/*
- www.caterallenonline.co.uk/
- www.caterallenonline.co.uk/*
- www.cbdibusiness.ae/*
- www.cbdibusiness.ae/cb/servlet/cb/login.jsp*
- www.ceconline.ro/*
- www.ceconline.ro/smartoffice/logon.htm*
- www.centrum24.pl/*
- www.centrum24.pl/centrum24-web/login
- www.chase.com/
- www.chase.com/*
- www.chase.com/business-banking*
- www.chase.com/checking*
- www.chase.com/commercial-bank*
- www.chase.com/commercial-bank/chase-commercial-online*
- www.chase.com/content/chasecom/en/credit-cards/rtbl/verify-credit-card
- www.chase.com/credit-cards*
- www.chase.com/espanol*
- www.chase.com/home-equity*
- www.chase.com/investments*
- www.chase.com/mobile-banking*
- www.chase.com/mortgage*
- www.chase.com/online-banking*
- www.chase.com/online/Credit-Cards/disney.htm
- www.chase.com/online/private_client*
- www.chase.com/personal-banking*
- www.chase.com/private-client*
- www.chase.com/resources*
- www.chase.com/savings*
- www.chase.com/student-loans*
- www.chebanca.it/*
- www.chebanca.it/wps/portal/Istituzionale/login*
- www.cimb.bizchannel.com.my/*
- www.cimb.bizchannel.com.my/corp/common2/login.do*
- www.citi*.com/credit-cards/creditcards/CitiHome.do*
- www.citibank.com.au/*
- www.citibank.com.au/AUGCB/JSO/signon/DisplayUsernameSignon.do*
- www.citibank.com.my/*
- www.citibank.com.my/MYGCB/JSO/signon/DisplayUsernameSignon.do
- www.citibank.com.sg/*
- www.citibank.com.sg/SGGCB/JSO/signon/DisplayUsernameSignon.do*
- www.citibankonline.pl/*
- www.citibankonline.pl/PLGCB/JPS/portal/SignonLocaleSwitch.do*
- www.citibusiness.citibank.com.sg/*
- www.citibusiness.citibank.com.sg/SGCBZ/JSO/signon/DisplayUsernameSignon.do*
- www.citigold.com.my/*
- www.citigold.com.my/MYGCB/JSO/signon/DisplayUsernameSignon.do
- www.cmb-home.com/*
- www.cmb-home.com/online/site002index.itm*
- www.co-operativebank.co.nz/*
- www.co-operativebank.co.nz/InternetBankingSecure/t/iblogin.aspx
- www.colonialfirststate.com.au/*
- www.colonialfirststate.com.au/firstnet/login.aspx*
- www.colonialfirststate.com.au/FNMaster/masterLoginFrames.asp
- www.comercios.cetelem.es/*
- www.comercios.cetelem.es/FcControlador.srvl;jsessionid=VyZ7VLYHWr1kwmTLRbGBgSvLb3LMMXN5YNBpNGjPpGTvysQQHyYK!-2062353136*
- www.commercial.hsbc.com.hk/*
- www.commercial.hsbc.com.hk/1/2/!ut/p/c5/04_SB8K8xLLM9MSSzPy8xBz9CP0os3gDd-NQv1BDg2AXA1-PEE9zPwtDAwgAykeaxTu7O3qYmPsA-WGergaeJk4mBqa-boYGnsbYdPsidBfkhioCAMGAADI!/*
- www.continentalnetcash.com.pe/*
- www.continentalnetcash.com.pe/KDPOSolicitarCredenciales_es.html
- www.contractmanager.asr.nl/
- www.contractmanager.asr.nl/*
- www.corealdirect.de/*
- www.corealdirect.de/corealcredit/abaxx-*
- www.corpnet.lu/*
- www.corpnet.lu/corpnet/loginCorp.jsp*
- www.corporate-clients.commerzbank.com/*
- www.corporate-clients.commerzbank.com/S-Portal/SHTML/cdir2/companydirectportal/pgf.html*
- www.coventrybuildingsociety.co.uk/*
- www.coventrybuildingsociety.co.uk/onlineservices/login/ols_login.aspx*
- www.credit-cooperatif.coop/*
- www.credit-cooperatif.coop/portail/particuliers/login.do
- www.credit-suisse.com.sg/
- www.credit-suisse.com.sg/*
- www.ct6.e-i.com/*
- www.ct6.e-i.com/wlib_sharedresources/sson/ssonsign/sign_extranet.asp*
- www.da.bdsonline.nl
- www.da.bdsonline.nl/*
- www.dab-bank.de/*
- www.dab-bank.de/Mein-Konto-Depot/Login*
- www.danskebank.dk/*
- www.danskebank.dk/da-dk/Erhverv/Mellem-erhverv/Online-services/Support/Pages/Support.aspx*
- www.danskebank.dk/da-dk/Erhverv/Mindre-erhverv/Netbank/Support/Pages/Support.aspx*
- www.danskebank.dk/da-dk/Privat/Selvbetjening/Produkter/Letbank/Pages/Log-ind-ji.aspx*
- www.danskebank.dk/da-dk/Privat/Selvbetjening/raadgivning/Teknisk-support/Pages/Teknisk-support.aspx*
- www.danskebank.fi/*
- www.danskebank.fi/en-fi/business/Medium-business/Online-services/Pages/Online-services.aspx*
- www.danskebank.fi/en-fi/Personal/Pages/Personal.aspx*
- www.danskebank.fi/fi-fi/Henkiloasiakkaat/Pages/henkiloasiakkaat.aspx*
- www.danskebank.fi/fi-fi/yritysasiakkaat/Pages/yritysasiakkaat.aspx*
- www.danskebank.fi/sv-fi/Foretag/Medelstora-foretag/Webbtjanster/Pages/Webbtjanster.aspx*
- www.danskebank.fi/sv-fi/OmBanken/Ombanken/Pages/Ombanken.aspx*
- www.danskebank.fi/sv-fi/Privat/Pages/Privat.aspx*
- www.danskebank.no/*
- www.danskebank.no/nb-no/Bedrift/Mellomstore-bedrifter/Nettbank/Pages/Nettbank.aspx*
- www.danskebank.no/nb-no/Privat/Nettbank-og-Mobil/nettbank/support/Pages/support.aspx*
- www.dbsvonline.com/*
- www.dbsvonline.com/english/index.asp*
- www.degussa-bank.de/*
- www.degussa-bank.de/login*
- www.denzelbank.at/*
- www.denzelbank.at/Sparen/Login.aspx
- www.deutschebank-dbdirect.com/*
- www.deutschebank-dbdirect.com/cas/login*
- www.discover.com/
- www.discover.com/[?]*
- www.discover.com/online-banking/
- www.discover.com/online-banking/[?]*
- www.discoverbank.com/bankac/loginreg/login*
- www.discoverbank.com/bankac/loginreg/submitlogin
- www.discovercard.com/cardmembersvcs/achome/homepage*
- www.discovercard.com/cardmembersvcs/loginlogout/app/ac_main*
- www.discovercard.com/cardmembersvcs/loginlogout/app/signin*
- www.discovercard.com/cardmembersvcs/personalprofile/pp/MyProfilePage*
- www.discovercard.com/snapshoot/29
- www.dnb.se/*
- www.dnb.se/cim
- www.dotmailer.com/login/*
- www.dslbank.de/*
- www.dslbank.de/dienste/partner/login.html*
- www.e-ambiz.com.my/*
- www.e-ambiz.com.my/bon/jsp/common/loginfiles/Login.bon*
- www.ebanking.hsbc.co.nz/*
- www.ebanking.hsbc.co.nz/1/2/!ut/p/c5/jZBdC4IwGEZ_0vtuI6VLXTitmeGa6G5kiIigMyKK_n3rJrrpg-fynHPzgAE_Z6_jYC_j4uwENZigzYMQOd0yFLwIkJbZmsu4JCJhnjefecn-qkklokxTLEjquUxCKsUBxRF_1Kp3rVawT5e5hwZM-CYr8ZTzjVzFyDhn0Ez9YLv7d0-Rl6cdVG45z_6D06zr205GD_hDJm4!/dl3/d3/L0lJSklna21BL0lKakFBTXlBQkVSQ0pBISEvNEZHZ3NvMFZ2emE5SUFnIS83X002NzBDMkozMEdTRzYwMlJNREw1QjAzQ0MzL*
- www.epargne-entreprise.federal-finance.fr/*
- www.epargne-entreprise.federal-finance.fr/ent/start.swe*
- www.eurocredito.es/*
- www.eurocredito.es/zonaClienteEurocredito/FcControlador.srvl*
- www.exane.com
- www.exane.com/*
- www.expressfaktura.se/*
- www.factocicpartnet.com/*
- www.factocicpartnet.com/factocicWeb
- www.factorbank.com/*
- www.factorbank.com/clients.php
- www.fcsolb.com/*
- www.fcsolb.com/cb/pages/jsp-ns/login.jsp*
- www.fibi-online.co.il/*
- www.fibi-online.co.il/web/swisswwwc
- www.fidelity.com/
- www.fidelity.com/login/accountposition
- www.fidelity.com/login/portfolio*
- www.fidelity.com/lpp/homepage-a*
- www.fidunet.lu/*
- www.fidunet.lu/fidunet/loginFidu.jsp*
- www.fineco.it/*
- www.fineco.it/it/public*
- www.firstmeritib.com/*
- www.firstmeritib.com/ec/DefaultCorp.aspx*
- www.flexipurchase.com/*
- www.flexipurchase.com/secure/welcome.asp*
- www.fnb.co.za/
- www.fnb.co.za/*
- www.four51.com/ui/logon.aspx
- www.francesnetcash.com.ar/*
- www.francesnetcash.com.ar/local_pibee/KDPOSolicitarCredenciales_en.html
- www.francesnetcash.com.ar/local_pibee/KDPOSolicitarCredenciales_es.html
- www.frostbank.com/cgi-bin/ecomm/portal/myfrostnew/signin/challenge.jsp*
- www.frostbank.com/cgi-bin/ecomm/portal/signin/enterusername.do*
- www.frostbank.com/pages/default.aspx
- www.frostcashmanager.com/*
- www.frostcashmanager.com/CASHplus*
- www.fsifulfillment.com/fsienterprise/Account/Login*
- www.gecapitalbank.com/*
- www.gecapitalbank.com/gecb/app/login*
- www.gemyaccounts.com/*
- www.gemyaccounts.com/myaccounts/Index.html*
- www.gerrard.com/*
- www.gerrard.com/clientcentre/login.aspx
- www.goldman.com/*
- www.goldman.com/login/login_a.cgi*
- www.gs.reyrey.com/*
- www.gs.reyrey.com/common/login/login.aspx*
- www.gtb.unicredit.eu/*
- www.gtb.unicredit.eu/login*
- www.halifax-online.co.uk/*
- www.halifax-online.co.uk/personal/logon/login.jsp*
- www.hancockbank.com/
- www.hawaiianbohcard.com/servicing/
- www.hawaiianbohcard.com/servicing/[?]*
- www.hawaiianbohcard.com/servicing/login*
- www.hongleongonline.com.my/*
- www.hongleongonline.com.my/business/index.jsp
- www.hsbc.co.uk/*
- www.hsbc.co.uk/1/2/!ut/p/c5/04_SB8K8xLLM9MSSzPy8xBz9CP0os3gDgzAfSycDUy8LAzNDbz8vbzMDKADKR5rFO7s7epiY-wD5YZ6uBp4mTiYGpr5uhgaexmDdFibeBn7enkEuBs4ejiYeRiHGMN1-Hvm5qfoFuRHlABOr0sE!*
- www.hsbc.com.au/*
- www.hsbc.com.au/1/2/HUB_IDV2/IDV_EPP*
- www.hsbc.com.my/*
- www.hsbc.com.my/1/2/!ut/p/c5/04_SB8K8xLLM9MSSzPy8xBz9CP0os3gDCxNvAz9vzyAXA2cPRxMPywBDAwgAykdiyjv5w-WJ0e1v6m5g6RNiYWngbeRvHGRqbECc7uDUvPjQYH0_j_zcVP1I_ShzDMWeniYwxZE5qemJyZXY1XljqgvN0w_Lyy_KBYZBQW5oRLm3jyMAwombdA!!/dl3/d3/L0lJSklna21BL0lKakFBTXlBQkVSQ0pBISEvNEZHZ3NvMFZ2emE5SUFnIS83XzA4NEswTktJUkQwQ0hBNEhJSTQwMDAwMDAwL*
- www.hsbc.com.sg/*
- www.hsbc.com.sg/1/2/!ut/p/c5/04_SB8K8xLLM9MSSzPy8xBz9CP0os3gDf6NAZ8tQU3c3A0dDV5MAf2MTAwjQL8h2VAQAdKy3eg!!/*
- www.hsbc.fr/*
- www.hsbc.fr/1/2/hsbc-france/entreprises-institutionnels/connexion
- www.hsbctrinkaus.de/*
- www.hsbctrinkaus.de/global/display/user*
- www.hvbrsce.com/*
- www.hvbrsce.com/ebanking/Athens/Pages/ElectronicBanking.htm*
- www.hypotirol.com/*
- www.hypotirol.com/at/privatkunden/hypo-online/hypo-online-banking/login.html
- www.ib.boq.com.au/*
- www.ib.boq.com.au/boqbl*
- www.ib.kiwibank.co.nz/
- www.ib.kiwibank.co.nz/*
- www.icloud.com/
- www.ims.bdsonline.nl
- www.ims.bdsonline.nl/*
- www.ing.be/*
- www.ing.be/de/business/Pages/Login.aspx
- www.ing.be/de/retail/Pages/Login.aspx
- www.ing.be/en/business/Pages/Login.aspx
- www.ing.be/en/retail/pages/login.aspx
- www.ing.be/fr/business/pages/login.aspx
- www.ing.be/fr/Retail/Pages/Login.aspx
- www.ing.be/nl/business/pages/login.aspx
- www.ing.be/nl/retail/pages/login.aspx
- www.ing.lu/*
- www.ing.lu/ING/FR/Particuliers/Login/index.htm
- www.ing.lu/web/ING/DE/Privatpersonen/Einloggen/index.htm
- www.ing.lu/web/ING/EN/Personal/Login/index.htm
- www.ing.lu/web/ING/FR/Personal/Login/index.htm
- www.ing.lu/web/ING/NL/Particuliers/Login/index.htm
- www.ingbank.cz/*
- www.ingbank.cz/ib/login
- www.ingdirect.com.au/*
- www.ingdirect.com.au/client/index.aspx
- www.ingonline.com/*
- www.ingonline.com/bg
- www.ingonline.com/cz
- www.ingonline.com/hu
- www.ingonline.com/pl
- www.ingonline.com/ro
- www.ingonline.com/ro/!UPR.Dispatcher*
- www.ingonline.com/sk
- www.interacciones.com/*
- www.interacciones.com/analisis/login.do
- www.interacciones.com/loginUsuario.do*
- www.interacciones.com/portalAgentes/login.jsp*
- www.internationalmoneytransfers.com.au/*
- www.internationalmoneytransfers.com.au/login/login
- www.internationalpayments.co.uk/
- www.internationalpayments.co.uk/*
- www.investbank.ae/*
- www.investbank.ae/ibank/loginAction.do*
- www.investimenti.unicredit.it/
- www.investimenti.unicredit.it/*
- www.inwestoronline.pl/*
- www.inwestoronline.pl/cbm/
- www.iombankibanking.com/*
- www.iombankibanking.com/eai/IPB_EAI_Web/eai*
- www.ipko.pl/
- www.ipko.pl/*
- www.kbc.be/*
- www.kbc.be/site*
- www.kbinternetbanking.com:8443/*
- www.kbinternetbanking.com:8443/ARCIB-NEWF/index.html*
- www.maybank2e.com/*
- www.maybank2e.com/SEA/m2e/portal/portal.view
- www.maybank2e.net/*
- www.maybank2e.net/M2E/mbbcustomer
- www.maybank2u.com.my/*
- www.maybank2u.com.my/mbb/m2u/common/M2ULogin.do*
- www.mcb-home.com/*
- www.mcb-home.com/online/site001index.itm*
- www.mcbb-home.com/*
- www.mcbb-home.com/online/site003index.itm*
- www.megabank.nl/*
- www.megabank.nl/portal/authentication/logonPassword.do
- www.megabank.nl/portal/authentication/logonToken.do
- www.mercantilcbonline.com/*
- www.mercantilcbonline.com/secure/banking/individualLogon*
- www.mercantilcbonline.com/secure/banking/logon*
- www.mercedes-benz-bank.de/*
- www.mercedes-benz-bank.de/intrade/login/login.jsf
- www.meritumbank.pl
- www.meritumbank.pl/*
- www.ml.com/
- www.ml.com/*
- www.mojebanka.cz/InternetBanking/
- www.my.commbank.com.au/*
- www.my.commbank.com.au/netbank/Logon/Logon.aspx*
- www.mybsn.com.my/*
- www.mybsn.com.my/mybsn/login/login.do
- www.mydegroof.fr
- www.mydegroof.fr/*
- www.mymerrill.com/*
- www.mymerrill.com/ml/home.aspx*
- www.natwestibanking.com/*
- www.natwestibanking.com/eai/IPB_EAI_Web/*
- www.netbank.nordea.dk/*
- www.netbank.nordea.dk/netbank/index.jsp
- www.netfonds.no/*
- www.netfonds.no/account/auth.php
- www.nettkonto.no
- www.nettkonto.no/*
- www.neuehelvetischebank.ch/*
- www.neuehelvetischebank.ch/e-banking.html
- www.nfsrv.com/
- www.nfsrv.com/*html
- www.noorinternetbanking.com/*
- www.noorinternetbanking.com/CWCLIENT/loginClient.action*
- www.nordeaim.nordea.com/*
- www.nordeaim.nordea.com/ImExt/WebportExt.nsf
- www.norvik.eu/*
- www.norvik.eu/en/intl
- www.novobanco.es/*
- www.novobanco.es/site/cms.aspx*
- www.nwolb.com/*
- www.nwolb.com/AccountSummary2.aspx
- www.nwolb.com/ChangeSettingsLandingPageA.aspx
- www.nwolb.com/default.aspx*
- www.nwolb.com/login.aspx*
- www.oberbank-banking.at/*
- www.oberbank-banking.at/obk/tiles/start.action
- www.obsgnet.com.mk/*
- www.obsgnet.com.mk/Retail/LoginModule/LoginToken.aspx*
- www.oney.es/*
- www.oney.es/OneyES_PrivateArea
- www.online-kundenservice.at/*
- www.online-kundenservice.at/index.php*
- www.onlinebanking.iombank.com/*
- www.onlinebanking.iombank.com/default.aspx*
- www.onlinebanking.natwestoffshore.com/*
- www.onlinebanking.natwestoffshore.com/default.aspx*
- www.onlinesbiglobal.com/*
- www.onlinesbiglobal.com/64SG/BANKAWAY*
- www.op-pohjola.fi/*
- www.op-pohjola.fi/yrityspalvelut*
- www.open24.ie/*
- www.open24.ie/online/login.aspx*
- www.otterbox.com/
- www.otterbox.com/en-us/account-login
- www.otterbox.com/en-us/source
- www.palatine.fr/*
- www.palatine.fr/espace-client-entreprises.html
- www.paymentnet.jpmorgan.com/
- www.paymentnet.jpmorgan.com/*
- www.paypal.com
- www.paypal.com/
- www.paypal.com/*cgi-bin/webscr?cmd=*account-refund*
- www.paypal.com/*cgi-bin/webscr?cmd=*contact-general*
- www.paypal.com/*cgi-bin/webscr?cmd=*express-checkout*
- www.paypal.com/*cgi-bin/webscr?cmd=*flow*
- www.paypal.com/*cgi-bin/webscr?cmd=*login-processing*
- www.paypal.com/*cgi-bin/webscr?cmd=*login-run*
- www.paypal.com/*cgi-bin/webscr?cmd=*login-submit*
- www.paypal.com/*cgi-bin/webscr?cmd=*run-check-cookie*
- www.paypal.com/*cgi-bin/webscr?token*
- www.paypal.com/??/home
- www.paypal.com/??/webapps/mpp/home*
- www.paypal.com/??/webapps/mpp/merchant
- www.paypal.com/auth/validatecaptcha
- www.paypal.com/businessexp/money*
- www.paypal.com/businessexp/summary*
- www.paypal.com/home
- www.paypal.com/login*
- www.paypal.com/myaccount/
- www.paypal.com/myaccount/[?]*
- www.paypal.com/myaccount/activity
- www.paypal.com/myaccount/home
- www.paypal.com/myaccount/settings
- www.paypal.com/signin*
- www.paypal.com/snapshoot/7
- www.paypal.com/webapps/business/
- www.paypal.com/webapps/business/moneyBasic
- www.paypal.com/webapps/customerprofile/summary.view
- www.paypal.com/webapps/mpp/home*
- www.paypal.com/webapps/mpp/merchant
- www.penser.se/*
- www.penser.se/sv/Logga-in/EPnet
- www.penser.se/sv/Logga-in/EPoint
- www.pohjola.fi/*
- www.pohjola.fi/linkki*
- www.portail.banque-solfea.fr/*
- www.portail.banque-solfea.fr/user/login
- www.postfinance.ch/*
- www.postfinance.ch/ap/ba/fp/html/e-finance/home*
- www.pouyanne.net/
- www.pouyanne.net/*
- www.privatebanking.societegenerale.com/*
- www.privatebanking.societegenerale.com/en/banking/luxembourg*
- www.privatebanking.societegenerale.com/en/banking/monaco*
- www.provincial.com/*
- www.provincial.com/personas/BBVAProvincial.jsp
- www.provincialnetcash.com/*
- www.provincialnetcash.com/KDPOSolicitarCredenciales_en.html
- www.provincialnetcash.com/KDPOSolicitarCredenciales_es.html
- www.publicmutualonline.com.my/
- www.publicmutualonline.com.my/*
- www.raiffeisenonline.ro/*
- www.raiffeisenonline.ro/eBankingWeb/login*
- www.rbsdigital.com/*
- www.rbsdigital.com/AccountSummary2.aspx*
- www.rbsdigital.com/ChangeSettingsLandingPageA.aspx
- www.rbsdigital.com/login.aspx*
- www.rbsidigital.com/*
- www.rbsidigital.com/default.aspx*
- www.rbsiibanking.com/*
- www.rbsiibanking.com/ipb/IPB_Client_Web/Start.do*
- www.regiobank.nl/*
- www.regiobank.nl/internetbankieren/secure/login.html
- www.regiobank.nl/internetbankieren/secure/loginzakelijk.html
- www.saastopankki.fi/*
- www.saastopankki.fi/yritysverkkopankkiin
- www.santanderbank.com/us/
- www.santanderbank.com/us/business*
- www.santanderbank.com/us/personal*
- www.sbisyd.com.au/*
- www.sbisyd.com.au/eremit/index.php
- www.sbm.no/*
- www.sbm.no/nettbank-logginn
- www.schwab.com/
- www.scotiaconnect.scotiabank.com/*
- www.scotiaconnect.scotiabank.com/sco-tp/pki/AuthenticateUserInputRoamingEPF.jsp
- www.scotiaconnect.scotiabank.com/sco-tp/pki/AuthenticateUserRoamingEPF.bns
- www.scotiaweb.com.mx/*
- www.scotiaweb.com.mx/hipotecario/hip_login.asp*
- www.secure.bnpparibas.net/*
- www.secure.bnpparibas.net/banque/portail/entrepros/HomeConnexion*
- www.secure.bnpparibas.net/banque/portail/particulier/Fiche*
- www.secure.bnpparibas.net/banque/portail/particulier/HomeConnexion*
- www.security.us.hsbc.com/gsa/SaaS30Resource/
- www.sft-ebanking.com/*
- www.sft-ebanking.com/siteminderagent/forms/dbloginsft.fcc*
- www.sg-bdp.pf/
- www.sg-bdp.pf/*
- www.sgcb.nc/*
- www.sgcb.nc/part/??/dciweb.htm*
- www.sgcb.nc/part/en/dciweb.htm*
- www.sgcb.nc/part/fr/dciweb.htm*
- www.shopify.com/login
- www.signatureny.web-access.com/*
- www.signatureny.web-access.com/signat/cgi-bin/login.cgi*
- www.skb.net/
- www.skb.net/Default.aspx
- www.snsbank.nl/*
- www.snsbank.nl/mijnsns/secure/login.html
- www.snsbank.nl/mijnsns/secure/loginzakelijk.html
- www.sogecashnet.ma/*
- www.sogecashnet.ma/smartoffice/index.htm*
- www.sogecashnet.ma/smartoffice/index_gb.htm
- www.sogehomebank.com/*
- www.sogehomebank.com/Retail/login.aspx*
- www.speedcommerce.com/*
- www.sprint.com/mysprint/pages/sl/global/login.jsp*
- www.sprocketexpress.com/portal/login.php
- www.standardlife.co.uk/*
- www.standardlife.co.uk/c1/login.page*
- www.superchoice.com.au/*
- www.superchoice.com.au/amp*
- www.superorganised.com.au/*
- www.superorganised.com.au/dashboard/login*
- www.svbconnect.com/*
- www.svbconnect.com/auth
- www.svbconnect.com/auth*
- www.swfulfillment.com/sfc/Login.asp
- www.sydbank.de/*
- www.sydbank.de/Sign/DE/_mcologon*
- www.synnex.ca/eng/ecexpress/index.shtml
- www.tdcardservices.com/TD_Consumer/Login.do*
- www.tdcardservices.com/TD_Consumer/ProcessLogin.do*
- www.tescobank.com/sss/auth
- www.tesoreria.cassacentrale.it/
- www.tesoreria.cassacentrale.it/*
- www.tesoreria.dedagroup.it/*
- www.tesoreria.dedagroup.it/bcc/
- www.tmbbizdirect.com/
- www.tmbbizdirect.com/*
- www.tranzact.org/
- www.tranzact.org/*
- www.treasury.pncbank.com/*
- www.treasury.pncbank.com/idp/esec/login.ht*
- www.ubank.com.au/
- www.ubank.com.au/*
- www.ubibanca.com/*
- www.ubibanca.com/Login_utilio
- www.ubs.com/*
- www.ubs.com/connect*
- www.uibanking-net.com/*
- www.uibanking-net.com/smartoffice/fr/connexion.html*
- www.uibanking-net.com/smartoffice/GB/connexion.html*
- www.ulsterbankanytimebanking.ie/*
- www.ulsterbankanytimebanking.ie/AccountSummary2.aspx*
- www.ulsterbankanytimebanking.ie/ChangeSettingsLandingPageA.aspx
- www.ulsterbankanytimebanking.ie/default.aspx*
- www.ulsterbankanytimebanking.ie/login.aspx*
- www.unicreditbank.ba/*
- www.unicreditbank.ba/eba/BHgradjani*
- www.unicreditbank.cz/*
- www.unicreditbank.cz/web/redirect.php*
- www.unicreditbank.sk/*
- www.unicreditbank.sk/i-banking-sk-https.html*
- www.unity-online.co.uk/
- www.unity-online.co.uk/*
- www.us.hsbc.com/1/2/3/personal/online-services/personal-internet-banking/view-accounts/view-accounts-post-registration-email
- www.us.hsbc.com/1/2/home/personal-banking
- www.us.hsbcprivatebank.com/1/2/!ut/p/c5/04_SB8K8xLLM9MSSzPy8xBz9CP0os3gTR1d3dwN3A293C09TA0dvz7BQR5dgI4NgI6B8JG55CzNidDu7O3qYmPsYGBiEeboaeJo4mRiY*
- www.usbank.com/index.html*
- www.usbank.com/small-business/index.html*
- www.vancity.com/*
- www.vancity.com/BusinessBanking/OnlineBanking/MyAccounts*
- www.vanlanschot.com/*
- www.vanlanschot.com/ebanking/myportal/FvLnl2
- www.volkswagenbank.de/*
- www.volkswagenbank.de/PortalLogin/get/Error.aspx/*
- www.volkswagenbank.es/*
- www.volkswagenbank.es/clientes/central_particular.jsp
- www.volkswagenbank.es/html/central_empresas.jsp
- www.wellsfargo.com/
- www.wellsfargo.com/biz*
- www.wib-home.com/*
- www.wib-home.com/online/site004index.itm*
- www.wireless.att.com/business/
- www.wireless.att.com/business/index.jsp*
- www.youinvest.co.uk/*
- www.youinvest.co.uk/LogIn/username*
- www.zaba.hr/*
- www.zaba.hr/ebank/gradjani/Prijava*
- www1.rbcbankusa.com/*
- www1.rbcbankusa.com/cgi-bin/rbaccess/rbunxcgi*
- www2.bancopastor.es/*
- www2.bancopastor.es/empresasBP
- www2.bancopastor.es/particularesBP
- www2.firstdirect.com/*
- www2.firstdirect.com/1/2/!ut/p/c5/04_SB8K8xLLM9MSSzPy8xBz9CP0os3gDgzAfSycDUy8LAzNDbz8vbzMDKADKR5rFO7s7epiY-wD5YZ6uBp4mTiYGpr5uhgaexmDdFibeBn7enkEuBs4ejiYeHkGGMN0FuaGKAPRSfDc!*
- www2.handelsbanken.fi/*
- www2.handelsbanken.fi/Tapas/tapas/hb/login
- www2.pbebank.com/*
- www2.pbebank.com/myIBK/apppbb/servlet/BxxxServlet*
- www2.pbebank.com/PBL
- www2.poppankki.fi/*
- www2.poppankki.fi/VerkkopalvelutWeb/sisaankirjaus/lomake_valinta.jsp*
- www2.secure.hsbcnet.com/*
- www2.secure.hsbcnet.com/uims/portal/IDV_CAM10_AUTHENTICATION*
- www2.targobank.es/*
- www2.targobank.es/empresasI
- www2.targobank.es/particularesI
- www22.bmo.com/*
- www22.bmo.com/ctpauth/CTPEAILogin/CustUserPasswordAuthServlet*
- www4.banquewormser.com/
- www4.banquewormser.com/*
- www6.rbc.com/*
- www6.rbc.com/webapp/ukv0/signin/logon.xhtml*
- www8.comerica.com/*
- www8.comerica.com/pkmslogin.form*
- www?.my.commbiz.commbank.com.au/*
- www?.my.commbiz.commbank.com.au/Logon/UserMaintenance/Login.aspx*
- wwwsec.ebanking.zugerkb.ch/*
- wwwsec.ebanking.zugerkb.ch/authen/login*
- wwwsec.valiant.ch/*
- wwwsec.valiant.ch/authen/login*
- youwebcard.bancopopolare.it/*
The following are the server IP addresses responsible for injecting malicious codes for matched URLs listed above:
- http://{BLOCKED}.{BLOCKED}.25.58/redirect.php
- http://{BLOCKED}.{BLOCKED}.25.58/second.php
- http://{BLOCKED}.{BLOCKED}.202.99:443/account/{value}
- http://{BLOCKED}.{BLOCKED}.202.99:443/getq/{value}
- http://{BLOCKED}.{BLOCKED}.202.99:443/info/{value}
- http://{BLOCKED}.{BLOCKED}.202.99:443/login/{value}
- http://{BLOCKED}.{BLOCKED}.202.99:443/rcrd/{value}
The following are the proxy addresses used for man-in-the-middle attacks:
- {BLOCKED}.{BLOCKED}.105.117:443
- {BLOCKED}.{BLOCKED}.202.99:443
It sends the following GET request:
/1509uk77/{Computer Name}_{OS patform}.{BOTID}/{value}/{data/variable}/{BLOCKED}.{BLOCKED}.6.243/
It sends a POST request to send stolen information from the injection.
SOLUTION
9.750
11.920.09
15 Sep 2015
11.921.00
16 Sep 2015
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 2
Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.
Step 3
Restart in Safe Mode
Step 4
Search and delete this file
- %System%\config\systemprofile\AppData\Local\{random filename} (for Windows Vista and above)
- %AppDataLocal%\{random filename} (for Windows XP and below}
Step 5
Restore this modified registry value
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
- From: LimitBlankPasswordUse = 0
To: LimitBlankPasswordUse = 1
- From: LimitBlankPasswordUse = 0
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
- From: fDenyTSConnections = 0
To: fDenyTSConnections = 1
- From: fDenyTSConnections = 0
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
- From: fSingleSessionPerUser = 0
To: fSingleSessionPerUser = 1
- From: fSingleSessionPerUser = 0
Step 6
Delete the Scheduled Tasks added by this malware/grayware
To delete the added Scheduled Task file:
For Windows 2000, Windows XP, and Windows Server 2003:
- Open the Windows Scheduled Tasks. To do this, click Start>Programs>Accessories>System Tools>Scheduled Tasks.
- Double-click on a .JOB file.
- Check if the malware path and file name exists in the .JOB file. To do this, check the value in the Run field.
- If found, select the .JOB file then press SHIFT+DELETE to permanently delete the file.
- Repeat the steps above for the remaining .JOB files.
For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:
- Open the Windows Task Scheduler. To do this:
• On Windows Vista, Windows 7, and Windows Server 2008, click Start, type taskschd.msc in the Search input field, then press Enter.
• On Windows 8, Windows 8.1, and Windows Server 2012, right-click on the lower left corner of the screen, click Run, type taskschd.msc, then press Enter. - In the left panel of the Task Scheduler Window, click Task Scheduler Library.
- In the upper-middle panel, click a Task.
- In the lower middle panel, click the Actions tab
- Check if the malware path and file name exists in the task. To do this, check the value in the Details column under the Actions tab.
- If found, select the task and press DELETE and click Yes to delete the task.
- Repeat the steps above for the remaining tasks.
Step 7
Restart in normal mode and scan your computer with your Trend Micro product for files detected as TSPY_DYRE.XXA. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.