www.lawmantra.com.au

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 23.234.229.68, located in Canyon Country, United States and belongs to MULTA-ASN1 - MULTACOM CORPORATION, US. The main domain is www.lawmantra.com.au.
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 14th 2017. Valid for: 3 months.

This is the only time www.lawmantra.com.au was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: USAA (Banking)

Domain & IP information

	IP Address	AS Autonomous System
5	23.234.229.68 23.234.229.68	35916 (MULTA-ASN1) (MULTA-ASN1 - MULTACOM CORPORATION)
1	104.108.43.121 104.108.43.121	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
6	2

5 23.234.229.68 (Canyon Country, United States)

ASN35916 (MULTA-ASN1 - MULTACOM CORPORATION, US)
PTR: hclnx.thesecurededicatedserver.com

www.lawmantra.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.108.43.121 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-108-43-121.deploy.static.akamaitechnologies.com

content.usaa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	lawmantra.com.au www.lawmantra.com.au	260 KB
1	usaa.com content.usaa.com	3 KB
6	2

	Domain	Requested by
5	www.lawmantra.com.au	www.lawmantra.com.au
1	content.usaa.com	www.lawmantra.com.au
6	2

This site contains no links.

Subject Issuer	Validity	Valid
lawmantra.com.au cPanel, Inc. Certification Authority	`2017-05-14` - `2017-08-12`	3 months	crt.sh
www.usaa.com Symantec Class 3 EV SSL CA - G3	`2017-01-31` - `2018-03-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/pin.php
Frame ID: 24839.1
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

263 kB
Transfer

263 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request pin.php Show response
www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/ 3 KB
3 KB 507ms
195ms Document
text/html 23.234.229.68
MULTACOM CORPORATION

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/pin.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.234.229.68 Canyon Country, United States, ASN35916 (MULTA-ASN1 - MULTACOM CORPORATION, US),
Reverse DNS: hclnx.thesecurededicatedserver.com
Software: Apache /
Resource Hash: db12de8dc1a169198f82922750940333a27a36470cdfd2959d4b08215b9e8a47

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: www.lawmantra.com.au
Accept-Language: en-US,en;q=0.8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Mon, 22 May 2017 16:57:39 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 3132
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK aggregator.css
www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/img/ 190 KB
190 KB 162ms
162ms Stylesheet
text/css 23.234.229.68
MULTACOM CORPORATION

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/img/aggregator.css
Requested by: Host: www.lawmantra.com.au
URL: https://www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/pin.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.234.229.68 Canyon Country, United States, ASN35916 (MULTA-ASN1 - MULTACOM CORPORATION, US),
Reverse DNS: hclnx.thesecurededicatedserver.com
Software: Apache /
Resource Hash: 9da8810bcf8f1cbf33a79dc4c9fede09b754a0694cf1c4befbf94a863e7032f1

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: www.lawmantra.com.au
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/pin.php
Connection: keep-alive
Cache-Control: no-cache
Referer: https://www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/pin.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Mon, 22 May 2017 16:57:39 GMT
Last-Modified: Sun, 10 Jan 2016 15:38:56 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 195053

GET
H/1.1 404
Not Found aggregator.css
www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/imgs/ 0
0 489ms
167ms Stylesheet
text/html 23.234.229.68
MULTACOM CORPORATION

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/imgs/aggregator.css
Requested by: Host: www.lawmantra.com.au
URL: https://www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/pin.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.234.229.68 Canyon Country, United States, ASN35916 (MULTA-ASN1 - MULTACOM CORPORATION, US),
Reverse DNS: hclnx.thesecurededicatedserver.com
Software: Apache /
Resource Hash

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: www.lawmantra.com.au
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/pin.php
Connection: keep-alive
Cache-Control: no-cache
Referer: https://www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/pin.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Mon, 22 May 2017 16:57:40 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 373
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK Capture14.PNG
www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/ 31 KB
31 KB 177ms
177ms Image
image/png 23.234.229.68
MULTACOM CORPORATION

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/Capture14.PNG
Requested by: Host: www.lawmantra.com.au
URL: https://www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/pin.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.234.229.68 Canyon Country, United States, ASN35916 (MULTA-ASN1 - MULTACOM CORPORATION, US),
Reverse DNS: hclnx.thesecurededicatedserver.com
Software: Apache /
Resource Hash: 550b8d8097ad9b09f884d9bcf0f223b52e89306dbb02b977d57dc36f950dee83

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: www.lawmantra.com.au
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/pin.php
Connection: keep-alive
Cache-Control: no-cache
Referer: https://www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/pin.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Mon, 22 May 2017 16:57:40 GMT
Last-Modified: Tue, 02 Aug 2016 00:56:10 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 31250

GET
H/1.1 200
OK Capture11.PNG
www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/ 36 KB
36 KB 167ms
167ms Image
image/png 23.234.229.68
MULTACOM CORPORATION

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/Capture11.PNG
Requested by: Host: www.lawmantra.com.au
URL: https://www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/pin.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.234.229.68 Canyon Country, United States, ASN35916 (MULTA-ASN1 - MULTACOM CORPORATION, US),
Reverse DNS: hclnx.thesecurededicatedserver.com
Software: Apache /
Resource Hash: f8a452b38c46c6307b693f244bae878a27c438bbb9b52625941b21b27a8f69b0

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: www.lawmantra.com.au
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/pin.php
Connection: keep-alive
Cache-Control: no-cache
Referer: https://www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/pin.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Mon, 22 May 2017 16:57:40 GMT
Last-Modified: Sun, 31 Jul 2016 04:40:56 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 37149

GET
H2 200 background_general_fb.png
content.usaa.com/mcontent/static_assets/Media/ 3 KB
3 KB 26ms
13ms Image
image/png 104.108.43.121
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.usaa.com/mcontent/static_assets/Media/background_general_fb.png?cacheid=2934981489_p

Requested by

Host: www.lawmantra.com.au
URL: https://www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/pin.php

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.43.121 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-108-43-121.deploy.static.akamaitechnologies.com

Software

USAA-Integrity /

Resource Hash

e2e04a8e937f5b74a4c50cb7592a8e0bba54b40818d44e43ffd5c40c6b4fe72a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /mcontent/static_assets/Media/background_general_fb.png?cacheid=2934981489_p
pragma: no-cache
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
accept: image/webp,image/*,*/*;q=0.8
cache-control: no-cache
:authority: content.usaa.com
referer: https://www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/img/aggregator.css
:scheme: https
:method: GET
Referer: https://www.lawmantra.com.au/images/cgi-bin/www.usaa.com/logsusaa/img/aggregator.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

date: Mon, 22 May 2017 16:57:41 GMT
last-modified: Mon, 16 Sep 2013 11:24:14 GMT
server: USAA-Integrity
etag: "b13-4e67e71a8d380"
strict-transport-security: max-age=31536000
p3p: policyref="https://www.usaa.com/w3c/USAA_Full_P3P_Policy.xml", CP="IDC DSP COR CUR ADM DEV CUS DEV PSA IVA CON HIS TEL OPT OUR SAM IND PRE"
status: 200
cache-control: max-age=578476
set-cookie: akmachineid=akmaTGB+Nbr0rjTUDwZuFGQwIpDgcsErKwrAPiwdATGuVBUilKJpdSfy/tYpzSUN8x3t4KQQ9+o2PlzC/epX3TksYQ==; expires=Thu, 20-May-2027 16:57:41 GMT; Secure; Path=/; domain=.usaa.com akusaa=akusaaV25jobHtLXJtmW5rKHrF7FA5m9SGiHpVK7u7+rU10jxo+tnBvyd3SXCDwY6rMFjdpBaDrqK5RJXXIMQ0H/3e9A==; expires=Thu, 20-May-2027 16:57:41 GMT; Secure; Path=/; domain=.usaa.com
accept-ranges: bytes
content-type: image/png
content-length: 2835

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: USAA (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

content.usaa.com
www.lawmantra.com.au
104.108.43.121
23.234.229.68
550b8d8097ad9b09f884d9bcf0f223b52e89306dbb02b977d57dc36f950dee83
9da8810bcf8f1cbf33a79dc4c9fede09b754a0694cf1c4befbf94a863e7032f1
db12de8dc1a169198f82922750940333a27a36470cdfd2959d4b08215b9e8a47
e2e04a8e937f5b74a4c50cb7592a8e0bba54b40818d44e43ffd5c40c6b4fe72a
f8a452b38c46c6307b693f244bae878a27c438bbb9b52625941b21b27a8f69b0

www.lawmantra.com.au Open in urlscan Pro 23.234.229.68 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

263 kBTransfer

263 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

www.lawmantra.com.au Open in urlscan Pro
23.234.229.68 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

263 kB
Transfer

263 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!