platinumremovals.com.au

Summary

This website contacted 1 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 192.124.249.56, located in United States and belongs to SUCURI-SEC - Sucuri, US. The main domain is platinumremovals.com.au.

This is the only time platinumremovals.com.au was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AT&T (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1 1	151.101.65.195 151.101.65.195	54113 (FASTLY) (FASTLY - Fastly)
6	192.124.249.56 192.124.249.56	30148 (SUCURI-SEC) (SUCURI-SEC - Sucuri)
6	1

1 151.101.65.195 (United States) 1 redirects

ASN54113 (FASTLY - Fastly, US)

pug.gl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 192.124.249.56 (United States)

ASN30148 (SUCURI-SEC - Sucuri, US)
PTR: cloudproxy10056.sucuri.net

platinumremovals.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	platinumremovals.com.au platinumremovals.com.au	142 KB
1	pug.gl 1 redirects pug.gl	343 B
6	2

	Domain	Requested by
6	platinumremovals.com.au	platinumremovals.com.au
1	pug.gl	1 redirects
6	2

This site contains no links.

Subject Issuer	Validity	Valid
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh

This page contains 1 frames:

Primary Page: http://platinumremovals.com.au/opec/att/index.html
Frame ID: 48CFD7ACED0480ADD287EA2C0B44C95E
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://pug.gl/qj HTTP 302
http://platinumremovals.com.au/opec/att/index.html Page URL

Page Statistics

6
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

142 kB
Transfer

141 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://pug.gl/qj HTTP 302
http://platinumremovals.com.au/opec/att/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request index.html Show response
platinumremovals.com.au/opec/att/
Redirect Chain

https://pug.gl/qj
http://platinumremovals.com.au/opec/att/index.html

2 KB
1 KB

568ms
516ms

Document
text/html

192.124.249.56
Sucuri

General

Check archive.org

Show headers Download Go to

Full URL

http://platinumremovals.com.au/opec/att/index.html

Protocol

HTTP/1.1

Server

192.124.249.56 , United States, ASN30148 (SUCURI-SEC - Sucuri, US),

Reverse DNS

cloudproxy10056.sucuri.net

Software

Sucuri/Cloudproxy /

Resource Hash

ec89edcae2c5143baed2bae7cf30070b517575e0a74381a612aa24756b26e4d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Host: platinumremovals.com.au
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: none
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1

Response headers

Server: Sucuri/Cloudproxy
Date: Thu, 15 Aug 2019 18:59:13 GMT
Content-Type: text/html
Content-Length: 684
Connection: keep-alive
X-Sucuri-ID: 19006
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Last-Modified: Wed, 29 Aug 2018 07:00:00 GMT
ETag: "581b59-71f-5748d81c5fc00-gzip"
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
X-Sucuri-Cache: EXPIRED
Accept-Ranges: bytes

Redirect headers

status: 302
server: nginx
content-type: text/html; charset=utf-8
access-control-allow-origin: *
function-execution-id: dv9ww3oke0te
location: http://platinumremovals.com.au/opec/att/index.html
x-powered-by: Express
x-cloud-trace-context: 9bac99be048d6c2181eb653ff8921d95;o=1
content-encoding: gzip
cache-control: private
accept-ranges: bytes bytes
date: Thu, 15 Aug 2019 18:59:11 GMT
x-served-by: cache-lcy19269-LCY
x-cache: MISS
x-cache-hits: 0
x-timer: S1565895552.701101,VS0,VE295
vary: accept, x-fh-requested-host, accept-encoding, cookie, authorization

GET
H/1.1 200
OK paste172.jpg
platinumremovals.com.au/opec/att/images/ 106 KB
107 KB 557ms
556ms Image
image/jpeg 192.124.249.56
Sucuri

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://platinumremovals.com.au/opec/att/images/paste172.jpg

Requested by

Host: platinumremovals.com.au
URL: http://platinumremovals.com.au/opec/att/index.html

Protocol

HTTP/1.1

Security

, ,

Server

192.124.249.56 , United States, ASN30148 (SUCURI-SEC - Sucuri, US),

Reverse DNS

cloudproxy10056.sucuri.net

Software

Sucuri/Cloudproxy /

Resource Hash

8ed108a1d45bfaf3b84ce4cf797e420c5d72d4b60d0c75176e540ba5819b73d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://platinumremovals.com.au/opec/att/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 15 Aug 2019 18:59:13 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 29 Aug 2018 06:52:32 GMT
Server: Sucuri/Cloudproxy
ETag: "581b55-1a84a-5748d67120c00"
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
X-Sucuri-Cache: MISS
Cache-Control: max-age=315360000
X-Sucuri-ID: 19006
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 108618
X-XSS-Protection: 1; mode=block
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK paste173.jpg
platinumremovals.com.au/opec/att/images/ 24 KB
24 KB 835ms
809ms Image
image/jpeg 192.124.249.56
Sucuri

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://platinumremovals.com.au/opec/att/images/paste173.jpg

Requested by

Host: platinumremovals.com.au
URL: http://platinumremovals.com.au/opec/att/index.html

Protocol

HTTP/1.1

Security

, ,

Server

192.124.249.56 , United States, ASN30148 (SUCURI-SEC - Sucuri, US),

Reverse DNS

cloudproxy10056.sucuri.net

Software

Sucuri/Cloudproxy /

Resource Hash

6be8e1bde733ee898fd3c9b4764694e5e9193aa8ab0af15e142934fb34c7abb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://platinumremovals.com.au/opec/att/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 15 Aug 2019 18:59:13 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 29 Aug 2018 06:52:56 GMT
Server: Sucuri/Cloudproxy
ETag: "581b56-5ee5-5748d68804200"
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
X-Sucuri-Cache: MISS
Cache-Control: max-age=315360000
X-Sucuri-ID: 19006
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 24293
X-XSS-Protection: 1; mode=block
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK att.PNG
platinumremovals.com.au/opec/att/images/ 7 KB
7 KB 542ms
516ms Image
image/png 192.124.249.56
Sucuri

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://platinumremovals.com.au/opec/att/images/att.PNG

Requested by

Host: platinumremovals.com.au
URL: http://platinumremovals.com.au/opec/att/index.html

Protocol

HTTP/1.1

Security

, ,

Server

192.124.249.56 , United States, ASN30148 (SUCURI-SEC - Sucuri, US),

Reverse DNS

cloudproxy10056.sucuri.net

Software

Sucuri/Cloudproxy /

Resource Hash

2363a191ea387738d57c9f9c2b52f12ee8c519d9dc51e6b1122c988850ddea7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://platinumremovals.com.au/opec/att/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 15 Aug 2019 18:59:13 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 29 Aug 2018 06:56:24 GMT
Server: Sucuri/Cloudproxy
ETag: "581b54-1a89-5748d74e61600"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
X-Sucuri-Cache: MISS
Cache-Control: max-age=315360000
X-Sucuri-ID: 19006
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 6793
X-XSS-Protection: 1; mode=block
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK paste174.jpg
platinumremovals.com.au/opec/att/images/ 2 KB
2 KB 526ms
501ms Image
image/jpeg 192.124.249.56
Sucuri

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://platinumremovals.com.au/opec/att/images/paste174.jpg

Requested by

Host: platinumremovals.com.au
URL: http://platinumremovals.com.au/opec/att/index.html

Protocol

HTTP/1.1

Security

, ,

Server

192.124.249.56 , United States, ASN30148 (SUCURI-SEC - Sucuri, US),

Reverse DNS

cloudproxy10056.sucuri.net

Software

Sucuri/Cloudproxy /

Resource Hash

143f2b168571ecd59b39bb26e8eac3b9cdbecf4cbe64602885c77992cb1750ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://platinumremovals.com.au/opec/att/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 15 Aug 2019 18:59:13 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 29 Aug 2018 06:55:14 GMT
Server: Sucuri/Cloudproxy
ETag: "581b57-7d3-5748d70b9f880"
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
X-Sucuri-Cache: MISS
Cache-Control: max-age=315360000
X-Sucuri-ID: 19006
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2003
X-XSS-Protection: 1; mode=block
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK paste175.jpg
platinumremovals.com.au/opec/att/images/ 726 B
1 KB 69ms
34ms Image
image/jpeg 192.124.249.56
Sucuri

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://platinumremovals.com.au/opec/att/images/paste175.jpg

Requested by

Host: platinumremovals.com.au
URL: http://platinumremovals.com.au/opec/att/index.html

Protocol

HTTP/1.1

Security

, ,

Server

192.124.249.56 , United States, ASN30148 (SUCURI-SEC - Sucuri, US),

Reverse DNS

cloudproxy10056.sucuri.net

Software

Sucuri/Cloudproxy /

Resource Hash

ef3083621376ad5e1cb4574a1931e734a1f660aa2945b61cc71e5c38d34b4c25

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://platinumremovals.com.au/opec/att/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 15 Aug 2019 18:59:13 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 29 Aug 2018 06:55:40 GMT
Server: Sucuri/Cloudproxy
ETag: "581b58-2d6-5748d7246b300"
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
X-Sucuri-Cache: HIT
Cache-Control: max-age=315360000
X-Sucuri-ID: 19006
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 726
X-XSS-Protection: 1; mode=block
Expires: Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

platinumremovals.com.au
pug.gl
151.101.65.195
192.124.249.56
143f2b168571ecd59b39bb26e8eac3b9cdbecf4cbe64602885c77992cb1750ce
2363a191ea387738d57c9f9c2b52f12ee8c519d9dc51e6b1122c988850ddea7c
6be8e1bde733ee898fd3c9b4764694e5e9193aa8ab0af15e142934fb34c7abb9
8ed108a1d45bfaf3b84ce4cf797e420c5d72d4b60d0c75176e540ba5819b73d9
ec89edcae2c5143baed2bae7cf30070b517575e0a74381a612aa24756b26e4d8
ef3083621376ad5e1cb4574a1931e734a1f660aa2945b61cc71e5c38d34b4c25

platinumremovals.com.au Open in urlscan Pro 192.124.249.56 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

6 Requests

0 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

1 IPs

1 Countries

142 kBTransfer

141 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

platinumremovals.com.au Open in urlscan Pro
192.124.249.56 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

142 kB
Transfer

141 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!