www.lactacure.1touchlabs.com

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 162.241.24.155, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is www.lactacure.1touchlabs.com.
TLS certificate: Issued by R3 on March 1st 2022. Valid for: 3 months.

This is the only time www.lactacure.1touchlabs.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Commonwealth Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
5	162.241.24.155 162.241.24.155	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1	23.10.0.59 23.10.0.59	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	2

5 162.241.24.155 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: box5881.bluehost.com

www.lactacure.1touchlabs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.10.0.59 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-10-0-59.deploy.static.akamaitechnologies.com

static.my.commbank.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	1touchlabs.com www.lactacure.1touchlabs.com	32 KB
1	commbank.com.au static.my.commbank.com.au	20 KB
6	2

	Domain	Requested by
5	www.lactacure.1touchlabs.com	www.lactacure.1touchlabs.com
1	static.my.commbank.com.au	www.lactacure.1touchlabs.com
6	2

This site contains no links.

Subject Issuer	Validity	Valid
www.lactacure.1touchlabs.com R3	`2022-03-01` - `2022-05-30`	3 months	crt.sh
my.commbank.com.au Entrust Certification Authority - L1M	`2021-08-18` - `2022-08-19`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.lactacure.1touchlabs.com/wp-content/plugins/commbank-RD987-detail-otp-thank/index.html
Frame ID: 56F55B5FF6C0C0918988A1573D07BFEA
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

NetBank - Log on to NetBank - Enjoy simple and secure online banking from Commonwealth Bank

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

52 kB
Transfer

87 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request index.html Show response
www.lactacure.1touchlabs.com/wp-content/plugins/commbank-RD987-detail-otp-thank/ 9 KB
2 KB 870ms
414ms Document
text/html 162.241.24.155
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lactacure.1touchlabs.com/wp-content/plugins/commbank-RD987-detail-otp-thank/index.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.241.24.155 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box5881.bluehost.com
Software: Apache /
Resource Hash: 2fbc246447d932157c9d00c56e31a780120eb7e0267a30eb4e9a9507b448f2e7

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: jp-JP,jp;q=0.9

Response headers

date: Tue, 29 Mar 2022 04:32:18 GMT
server: Apache
content-type: text/html
content-length: 2308
last-modified: Mon, 28 Mar 2022 20:52:48 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
x-server-cache: false

GET
H2 200 logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css
www.lactacure.1touchlabs.com/wp-content/plugins/commbank-RD987-detail-otp-thank/css/ 39 KB
10 KB 334ms
334ms Stylesheet
text/css 162.241.24.155
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lactacure.1touchlabs.com/wp-content/plugins/commbank-RD987-detail-otp-thank/css/logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css
Requested by: Host: www.lactacure.1touchlabs.com
URL: https://www.lactacure.1touchlabs.com/wp-content/plugins/commbank-RD987-detail-otp-thank/index.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.241.24.155 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box5881.bluehost.com
Software: Apache /
Resource Hash: 53138c85740c6cd786e657deccaead3f732b021e116dc870e692609233c5381e

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: https://www.lactacure.1touchlabs.com/wp-content/plugins/commbank-RD987-detail-otp-thank/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 04:32:18 GMT
content-encoding: gzip
last-modified: Mon, 28 Mar 2022 20:52:48 GMT
server: Apache
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 10255

GET
H2 200 cba_mainlogo.ac9de6fb5214be84653367c74ba0b5f0.gif
www.lactacure.1touchlabs.com/wp-content/plugins/commbank-RD987-detail-otp-thank/images/ 5 KB
5 KB 185ms
184ms Image
image/gif 162.241.24.155
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lactacure.1touchlabs.com/wp-content/plugins/commbank-RD987-detail-otp-thank/images/cba_mainlogo.ac9de6fb5214be84653367c74ba0b5f0.gif
Requested by: Host: www.lactacure.1touchlabs.com
URL: https://www.lactacure.1touchlabs.com/wp-content/plugins/commbank-RD987-detail-otp-thank/index.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.241.24.155 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box5881.bluehost.com
Software: Apache /
Resource Hash: 4620bea7b8db9ffe1747e9c29910d7ea2ec84a7a3c7416e7a8a70e450073d820

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: https://www.lactacure.1touchlabs.com/wp-content/plugins/commbank-RD987-detail-otp-thank/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

accept-ranges: bytes
last-modified: Mon, 28 Mar 2022 20:52:48 GMT
server: Apache
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
date: Tue, 29 Mar 2022 04:32:18 GMT
content-length: 4852
content-type: image/gif

GET
H/1.1 200
OK Bill-Sense_NBLogon.png
static.my.commbank.com.au/static/cmxAssets/netbank-logon/ 20 KB
20 KB 220ms
18ms Image
image/png 23.10.0.59
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.my.commbank.com.au/static/cmxAssets/netbank-logon/Bill-Sense_NBLogon.png

Requested by

Host: www.lactacure.1touchlabs.com
URL: https://www.lactacure.1touchlabs.com/wp-content/plugins/commbank-RD987-detail-otp-thank/index.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.10.0.59 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-10-0-59.deploy.static.akamaitechnologies.com

Software

/

Resource Hash

e28ac79d9cd7eeafa72eb4700ba5b170c246012a34f3441f1abf22220fc50ff7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: https://www.lactacure.1touchlabs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date: Tue, 29 Mar 2022 04:32:18 GMT
Last-Modified: Mon, 14 Dec 2020 23:22:32 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000,must-revalidate,proxy-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 20431

GET
H2 500 hbg.0236e4e9a193069c4e8554db8b06354c.png
www.lactacure.1touchlabs.com/wp-content/plugins/commbank-RD987-detail-otp-thank/images/ 678 B
678 B 679ms
678ms Image
text/html 162.241.24.155
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lactacure.1touchlabs.com/wp-content/plugins/commbank-RD987-detail-otp-thank/images/hbg.0236e4e9a193069c4e8554db8b06354c.png
Requested by: Host: www.lactacure.1touchlabs.com
URL: https://www.lactacure.1touchlabs.com/wp-content/plugins/commbank-RD987-detail-otp-thank/css/logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.241.24.155 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box5881.bluehost.com
Software: Apache /
Resource Hash: ce63ff7b805ed139f35b6479d233866130e36c1840cdbc8afe88d9afc87c520d

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: https://www.lactacure.1touchlabs.com/wp-content/plugins/commbank-RD987-detail-otp-thank/css/logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 04:32:18 GMT
server: Apache
content-length: 678
content-type: text/html; charset=iso-8859-1

GET
H2 200 logonsprite2.307a0c523f35f709f390895b4720d350.png
www.lactacure.1touchlabs.com/wp-content/plugins/commbank-RD987-detail-otp-thank/images/ 14 KB
14 KB 239ms
238ms Image
image/png 162.241.24.155
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lactacure.1touchlabs.com/wp-content/plugins/commbank-RD987-detail-otp-thank/images/logonsprite2.307a0c523f35f709f390895b4720d350.png
Requested by: Host: www.lactacure.1touchlabs.com
URL: https://www.lactacure.1touchlabs.com/wp-content/plugins/commbank-RD987-detail-otp-thank/css/logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.241.24.155 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: box5881.bluehost.com
Software: Apache /
Resource Hash: c3787cbabd5c9acf9bfdc72c8e706754d644a14d5bd538e675c1885ccae87341

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: https://www.lactacure.1touchlabs.com/wp-content/plugins/commbank-RD987-detail-otp-thank/css/logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

accept-ranges: bytes
last-modified: Mon, 28 Mar 2022 20:52:48 GMT
server: Apache
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
date: Tue, 29 Mar 2022 04:32:19 GMT
content-length: 14207
content-type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Commonwealth Bank (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.lactacure.1touchlabs.com/wp-content/plugins/commbank-RD987-detail-otp-thank/images/hbg.0236e4e9a193069c4e8554db8b06354c.png Message: Failed to load resource: the server responded with a status of 500 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

static.my.commbank.com.au
www.lactacure.1touchlabs.com
162.241.24.155
23.10.0.59
2fbc246447d932157c9d00c56e31a780120eb7e0267a30eb4e9a9507b448f2e7
4620bea7b8db9ffe1747e9c29910d7ea2ec84a7a3c7416e7a8a70e450073d820
53138c85740c6cd786e657deccaead3f732b021e116dc870e692609233c5381e
c3787cbabd5c9acf9bfdc72c8e706754d644a14d5bd538e675c1885ccae87341
ce63ff7b805ed139f35b6479d233866130e36c1840cdbc8afe88d9afc87c520d
e28ac79d9cd7eeafa72eb4700ba5b170c246012a34f3441f1abf22220fc50ff7

www.lactacure.1touchlabs.com Open in urlscan Pro 162.241.24.155 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

52 kBTransfer

87 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

www.lactacure.1touchlabs.com Open in urlscan Pro
162.241.24.155 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

52 kB
Transfer

87 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!