lanplus.com.au Open in urlscan Pro
103.20.202.177 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://rehmatwala.com/thankyou
Effective URL:
https://lanplus.com.au/Bendigo/login.php
Submission: On September 30 via manual (September 30th 2023, 7:42:14 am UTC) from AU — Scanned from SG

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 103.20.202.177, located in Australia and belongs to DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU. The main domain is lanplus.com.au.
TLS certificate: Issued by R3 on September 7th 2023. Valid for: 3 months.

This is the only time lanplus.com.au was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bendigo Bank (Banking)

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

	IP Address	AS Autonomous System
1 1	103.227.176.22 103.227.176.22	55293 (A2HOSTING) (A2HOSTING)
9	103.20.202.177 103.20.202.177	38719 (DREAMSCAP...) (DREAMSCAPE-AS-AP Dreamscape Networks Limited)
9	1

1 103.227.176.22 (Singapore) 1 redirects

ASN55293 (A2HOSTING, US)
PTR: sg1-lr1.supercp.com

rehmatwala.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 103.20.202.177 (Australia)

ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU)
PTR: server-4x-r67.ipv4.syd02.ds.network

lanplus.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	lanplus.com.au lanplus.com.au	58 KB
1	rehmatwala.com 1 redirects rehmatwala.com	300 B
9	2

	Domain	Requested by
9	lanplus.com.au	lanplus.com.au
1	rehmatwala.com	1 redirects
9	2

This site contains no links.

Subject Issuer	Validity	Valid
mail.lanplus.com.au R3	`2023-09-07` - `2023-12-06`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://lanplus.com.au/Bendigo/login.php
Frame ID: 2986AF5FA228BE4BC155A229B826B782
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Bendigo Bank - Logon to e-banking

Page URL History Show full URLs

https://rehmatwala.com/thankyou HTTP 301
https://lanplus.com.au/Bendigo/ Page URL
https://lanplus.com.au/Bendigo/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

58 kB
Transfer

92 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://rehmatwala.com/thankyou HTTP 301
https://lanplus.com.au/Bendigo/ Page URL
https://lanplus.com.au/Bendigo/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://rehmatwala.com/thankyou HTTP 301
https://lanplus.com.au/Bendigo/

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ lanplus.com.au/Bendigo/ Redirect Chain https://rehmatwala.com/thankyou https://lanplus.com.au/Bendigo/	53 B 208 B	316ms 119ms	Document text/html	103.20.202.177 DREAMSCAPE-AS-AP ...
General Check archive.org Show headers Download Go to Full URL https://lanplus.com.au/Bendigo/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 103.20.202.177 , Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU), Reverse DNS server-4x-r67.ipv4.syd02.ds.network Software nginx / PHP/7.3.33 Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 accept-language zh-SG,zh;q=0.9 Response headers content-encoding gzip content-type text/html; charset=UTF-8 date Sat, 30 Sep 2023 07:42:08 GMT server nginx vary Accept-Encoding x-powered-by PHP/7.3.33 Redirect headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 707 content-type text/html date Sat, 30 Sep 2023 07:42:08 GMT location https://lanplus.com.au/Bendigo/ server LiteSpeed strict-transport-security max-age=63072000; includeSubDomains x-content-type-options nosniff x-frame-options SAMEORIGIN
GET H2	200	Primary Request login.php Show response lanplus.com.au/Bendigo/	49 KB 14 KB	210ms 210ms	Document text/html	103.20.202.177 DREAMSCAPE-AS-AP ...
General Check archive.org Show headers Download Go to Full URL https://lanplus.com.au/Bendigo/login.php Requested by Host: lanplus.com.au URL: https://lanplus.com.au/Bendigo/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 103.20.202.177 , Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU), Reverse DNS server-4x-r67.ipv4.syd02.ds.network Software nginx / PHP/7.3.33 Resource Hash `86bfee26c39d256f330adaf00f835422512fe5bad36e97f8b4d3e46d9568db31` Request headers Referer https://lanplus.com.au/Bendigo/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 accept-language zh-SG,zh;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip content-type text/html; charset=UTF-8 date Sat, 30 Sep 2023 07:42:08 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server nginx vary Accept-Encoding x-powered-by PHP/7.3.33
GET H2	404	kb-banner.jpg lanplus.com.au/Bendigo/	43 KB 43 KB	340ms 340ms	Image text/html	103.20.202.177 DREAMSCAPE-AS-AP ...
General Check archive.org Show headers Download Go to Show image Full URL https://lanplus.com.au/Bendigo/kb-banner.jpg Requested by Host: lanplus.com.au URL: https://lanplus.com.au/Bendigo/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 103.20.202.177 , Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU), Reverse DNS server-4x-r67.ipv4.syd02.ds.network Software nginx / PHP/7.3.33 Resource Hash `f220f23f531c9226a45efd7f602910a98d4e80849a0fa098d308965bf5781760` Request headers accept-language zh-SG,zh;q=0.9 Referer https://lanplus.com.au/Bendigo/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers date Sat, 30 Sep 2023 07:42:08 GMT content-encoding gzip server nginx x-powered-by PHP/7.3.33 vary Accept-Encoding content-type text/html; charset=utf-8
GET H2	404	proximanova-regular__510298c5f4.woff2 lanplus.com.au/Bendigo/	0 0	339ms 338ms	Font text/html	103.20.202.177 DREAMSCAPE-AS-AP ...
General Check archive.org Show headers Download Go to Full URL https://lanplus.com.au/Bendigo/proximanova-regular__510298c5f4.woff2 Requested by Host: lanplus.com.au URL: https://lanplus.com.au/Bendigo/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 103.20.202.177 , Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU), Reverse DNS server-4x-r67.ipv4.syd02.ds.network Software nginx / PHP/7.3.33 Resource Hash Request headers Referer https://lanplus.com.au/Bendigo/login.php Origin https://lanplus.com.au accept-language zh-SG,zh;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers date Sat, 30 Sep 2023 07:42:08 GMT content-encoding gzip server nginx x-powered-by PHP/7.3.33 vary Accept-Encoding content-type text/html; charset=utf-8
GET H2	404	proximanova-bold__aac7e61091.woff2 lanplus.com.au/Bendigo/	0 0	244ms 243ms	Font text/html	103.20.202.177 DREAMSCAPE-AS-AP ...
General Check archive.org Show headers Download Go to Full URL https://lanplus.com.au/Bendigo/proximanova-bold__aac7e61091.woff2 Requested by Host: lanplus.com.au URL: https://lanplus.com.au/Bendigo/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 103.20.202.177 , Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU), Reverse DNS server-4x-r67.ipv4.syd02.ds.network Software nginx / PHP/7.3.33 Resource Hash Request headers Referer https://lanplus.com.au/Bendigo/login.php Origin https://lanplus.com.au accept-language zh-SG,zh;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers date Sat, 30 Sep 2023 07:42:08 GMT content-encoding gzip server nginx x-powered-by PHP/7.3.33 vary Accept-Encoding content-type text/html; charset=utf-8
GET H2	404	proximanova-bold__269a1d4c12.woff lanplus.com.au/Bendigo/	0 0	246ms 245ms	Font text/html	103.20.202.177 DREAMSCAPE-AS-AP ...
General Check archive.org Show headers Download Go to Full URL https://lanplus.com.au/Bendigo/proximanova-bold__269a1d4c12.woff Requested by Host: lanplus.com.au URL: https://lanplus.com.au/Bendigo/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 103.20.202.177 , Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU), Reverse DNS server-4x-r67.ipv4.syd02.ds.network Software nginx / PHP/7.3.33 Resource Hash Request headers Referer https://lanplus.com.au/Bendigo/login.php Origin https://lanplus.com.au accept-language zh-SG,zh;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers date Sat, 30 Sep 2023 07:42:09 GMT content-encoding gzip server nginx x-powered-by PHP/7.3.33 vary Accept-Encoding content-type text/html; charset=utf-8
GET H2	404	proximanova-regular__3432cf9630.woff lanplus.com.au/Bendigo/	0 0	235ms 234ms	Font text/html	103.20.202.177 DREAMSCAPE-AS-AP ...
General Check archive.org Show headers Download Go to Full URL https://lanplus.com.au/Bendigo/proximanova-regular__3432cf9630.woff Requested by Host: lanplus.com.au URL: https://lanplus.com.au/Bendigo/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 103.20.202.177 , Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU), Reverse DNS server-4x-r67.ipv4.syd02.ds.network Software nginx / PHP/7.3.33 Resource Hash Request headers Referer https://lanplus.com.au/Bendigo/login.php Origin https://lanplus.com.au accept-language zh-SG,zh;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers date Sat, 30 Sep 2023 07:42:09 GMT content-encoding gzip server nginx x-powered-by PHP/7.3.33 vary Accept-Encoding content-type text/html; charset=utf-8
GET H2	404	proximanova-bold__4190d9d59c.ttf lanplus.com.au/Bendigo/	0 0	259ms 259ms	Font text/html	103.20.202.177 DREAMSCAPE-AS-AP ...
General Check archive.org Show headers Download Go to Full URL https://lanplus.com.au/Bendigo/proximanova-bold__4190d9d59c.ttf Requested by Host: lanplus.com.au URL: https://lanplus.com.au/Bendigo/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 103.20.202.177 , Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU), Reverse DNS server-4x-r67.ipv4.syd02.ds.network Software nginx / PHP/7.3.33 Resource Hash Request headers Referer https://lanplus.com.au/Bendigo/login.php Origin https://lanplus.com.au accept-language zh-SG,zh;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers date Sat, 30 Sep 2023 07:42:09 GMT content-encoding gzip server nginx x-powered-by PHP/7.3.33 vary Accept-Encoding content-type text/html; charset=utf-8
GET H2	404	proximanova-regular__a96ee8d059.ttf lanplus.com.au/Bendigo/	0 0	244ms 244ms	Font text/html	103.20.202.177 DREAMSCAPE-AS-AP ...
General Check archive.org Show headers Download Go to Full URL https://lanplus.com.au/Bendigo/proximanova-regular__a96ee8d059.ttf Requested by Host: lanplus.com.au URL: https://lanplus.com.au/Bendigo/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 103.20.202.177 , Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU), Reverse DNS server-4x-r67.ipv4.syd02.ds.network Software nginx / PHP/7.3.33 Resource Hash Request headers Referer https://lanplus.com.au/Bendigo/login.php Origin https://lanplus.com.au accept-language zh-SG,zh;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers date Sat, 30 Sep 2023 07:42:09 GMT content-encoding gzip server nginx x-powered-by PHP/7.3.33 vary Accept-Encoding content-type text/html; charset=utf-8

Verdicts & Comments Add Verdict or Comment

Malicious task.url
Submitted on September 30th 2023, 7:44:04 am UTC — From Australia

Threats: Phishing
Brands: Bendigo Bank AU
Comment: Phishing url redirector targeting bendigo bank

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bendigo Bank (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
lanplus.com.au/	1969-12-31 23:59:59	Name: PHPSESSID Value: aea4dd0220029f0e4252b44d66d90216
.lanplus.com.au/	1970-01-20 15:50:51	Name: language Value: en-gb
.lanplus.com.au/	1970-01-20 15:50:51	Name: currency Value: AUD
lanplus.com.au/	1969-12-31 23:59:59	Name: OCSESSID Value: ce4e7a9797125cad3c6cc8c788

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://lanplus.com.au/Bendigo/proximanova-bold__aac7e61091.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://lanplus.com.au/Bendigo/proximanova-regular__510298c5f4.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://lanplus.com.au/Bendigo/kb-banner.jpg Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://lanplus.com.au/Bendigo/proximanova-bold__269a1d4c12.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://lanplus.com.au/Bendigo/proximanova-regular__3432cf9630.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://lanplus.com.au/Bendigo/proximanova-bold__4190d9d59c.ttf Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://lanplus.com.au/Bendigo/proximanova-regular__a96ee8d059.ttf Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lanplus.com.au
rehmatwala.com
103.20.202.177
103.227.176.22
86bfee26c39d256f330adaf00f835422512fe5bad36e97f8b4d3e46d9568db31
f220f23f531c9226a45efd7f602910a98d4e80849a0fa098d308965bf5781760

lanplus.com.au Open in urlscan Pro 103.20.202.177 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

1 IPs

2 Countries

58 kBTransfer

92 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Malicious task.url Submitted on September 30th 2023, 7:44:04 am UTC — From Australia

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

4 Cookies

7 Console Messages

Indicators

lanplus.com.au Open in urlscan Pro
103.20.202.177 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

58 kB
Transfer

92 kB
Size

4
Cookies

9 HTTP transactions
0 data transactions

Malicious task.url
Submitted on September 30th 2023, 7:44:04 am UTC — From Australia

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!