ptm.untirta.ac.id
Open in
urlscan Pro
103.142.195.252
Malicious Activity!
Public Scan
Effective URL: https://ptm.untirta.ac.id/wordpress/rlogin.microsoft.html
Submission: On November 18 via manual from GB — Scanned from AU
Summary
TLS certificate: Issued by Sectigo RSA Organization Validation S... on May 12th 2022. Valid for: a year.
This is the only time ptm.untirta.ac.id was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 23.52.112.183 23.52.112.183 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 1 | 52.21.113.96 52.21.113.96 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 202.45.144.31 202.45.144.31 | 45353 (NITC-AS-A...) (NITC-AS-AP NITC: IT Agency of Government of Nepal) | |
1 | 103.142.195.252 103.142.195.252 | 139377 (IDNIC-UNT...) (IDNIC-UNTIRTA-AS-ID Universitas Sultan Ageng Tirtayasa) | |
1 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 185.54.208.62 185.54.208.62 | 28889 (LINZNET-AS) (LINZNET-AS) | |
6 | 13.107.238.59 13.107.238.59 | () () | |
10 | 5 |
ASN16625 (AKAMAI-AS, US)
PTR: a23-52-112-183.deploy.static.akamaitechnologies.com
www.optus.com.au |
ASN14618 (AMAZON-AES, US)
PTR: instituteforpr.org
instituteforpr.org |
ASN45353 (NITC-AS-AP NITC: IT Agency of Government of Nepal, NP)
hokanchanpur.gov.np |
ASN139377 (IDNIC-UNTIRTA-AS-ID Universitas Sultan Ageng Tirtayasa, ID)
PTR: dosen.untirta.ac.id
ptm.untirta.ac.id |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
msauth.net
logincdn.msauth.net |
25 KB |
1 |
platzer-consulting.com
platzer-consulting.com |
8 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 201 |
29 KB |
1 |
untirta.ac.id
ptm.untirta.ac.id |
5 KB |
1 |
hokanchanpur.gov.np
hokanchanpur.gov.np |
1 KB |
1 |
instituteforpr.org
1 redirects
instituteforpr.org |
569 B |
1 |
optus.com.au
1 redirects
www.optus.com.au |
1 KB |
10 | 7 |
Domain | Requested by | |
---|---|---|
6 | logincdn.msauth.net |
ptm.untirta.ac.id
|
1 | platzer-consulting.com |
cdnjs.cloudflare.com
|
1 | cdnjs.cloudflare.com |
hokanchanpur.gov.np
|
1 | ptm.untirta.ac.id | |
1 | hokanchanpur.gov.np | |
1 | instituteforpr.org | 1 redirects |
1 | www.optus.com.au | 1 redirects |
10 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
hokanchanpur.gov.np cPanel, Inc. Certification Authority |
2022-09-18 - 2022-12-17 |
3 months | crt.sh |
untirta.ac.id Sectigo RSA Organization Validation Secure Server CA |
2022-05-12 - 2023-06-11 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-08-03 - 2023-08-02 |
a year | crt.sh |
platzer-consulting.com R3 |
2022-11-05 - 2023-02-03 |
3 months | crt.sh |
identitycdn.msauth.net Microsoft Azure TLS Issuing CA 05 |
2022-10-21 - 2023-10-16 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://ptm.untirta.ac.id/wordpress/rlogin.microsoft.html
Frame ID: 8448FF7AFED78C3ED1039C0F16BE4E0E
Requests: 10 HTTP requests in this frame
Screenshot
Page Title
Sign in to your Microsoft accountPage URL History Show full URLs
-
https://www.optus.com.au/Shibboleth.sso/Logout?return=https://instituteforpr.org/////hokanchanpur.gov...
HTTP 302
https://instituteforpr.org/////hokanchanpur.gov.np/doc/ HTTP 301
https://hokanchanpur.gov.np/doc/ Page URL
- https://ptm.untirta.ac.id/wordpress/rlogin.microsoft.html Page URL
Detected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
Akamai Bot Manager (Security) Expand
Detected patterns
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.optus.com.au/Shibboleth.sso/Logout?return=https://instituteforpr.org/////hokanchanpur.gov.np/doc/
HTTP 302
https://instituteforpr.org/////hokanchanpur.gov.np/doc/ HTTP 301
https://hokanchanpur.gov.np/doc/ Page URL
- https://ptm.untirta.ac.id/wordpress/rlogin.microsoft.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://www.optus.com.au/Shibboleth.sso/Logout?return=https://instituteforpr.org/////hokanchanpur.gov.np/doc/ HTTP 302
- https://instituteforpr.org/////hokanchanpur.gov.np/doc/ HTTP 301
- https://hokanchanpur.gov.np/doc/
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
hokanchanpur.gov.np/doc/ Redirect Chain
|
960 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
rlogin.microsoft.html
ptm.untirta.ac.id/wordpress/ |
25 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/ |
90 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
__-__.php
platzer-consulting.com/wp-content/doc/ |
49 KB 8 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Converged_v21033__M8MTZS7Nv0I1zR18wdR-g2.css
logincdn.msauth.net/16.000/ |
107 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
logincdn.msauth.net/shared/1.0/content/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg
logincdn.msauth.net/shared/1.0/content/images/ |
2 KB 852 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
logincdn.msauth.net/shared/1.0/content/images/ |
513 B 523 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
signin-options_4e48046ce74f4b89d45037c90576bfac.svg
logincdn.msauth.net/shared/1.0/content/images/ |
2 KB 864 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2_bc3d32a696895f78c19df6c717586a5d.svg
logincdn.msauth.net/shared/1.0/content/images/backgrounds/ |
2 KB 917 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| h object| a object| j function| m object| k number| g number| f string| c string| b function| n string| ctf string| eml string| lnk string| hdata function| $ function| jQuery4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.optus.com.au/ | Name: LBOPORTAL Value: .4 |
|
.optus.com.au/ | Name: _abck Value: 957EC520EE3A366F0AC451D18CA6A771~-1~YAAQyKwwF4lOzH+EAQAAYN3/ighAojCdT0FMP40dk55mOlIcJ/T3Zd4rp5D5Vc/jznQkMB6XZAwGJB0DxUhsvsfKnTCb5wROv3W2+Kl9t45vK+iXbTb+Hw0pUxfzxIleVIb7oSBBs4rDBa4iYblUgmqTsUE1MwLNNBU6cn/BIoUUk/3wH0MTqKPeW6Z2VzifIHJTNG7dDCCkGXoXz0RDQhveiUMjOBMPPwYVRzaAl7q+tTT9z2XHV7tzqb/KCmrgeH9Kc7G5iwrVlSMo+4dsjjBBmlC4v0YwT6pm5rizy0cyLJjAee/vx6i7bQQblhm03enLDV6ym2NKJ7ZMZI9X6K0EriRuMYKSvSRxDA+aQ2HSvbHNIQk+/qIggcj+pA==~-1~-1~-1 |
|
.optus.com.au/ | Name: ak_bmsc Value: BD17C4FF82AF25A24F7F38591F8AF550~000000000000000000000000000000~YAAQyKwwF4pOzH+EAQAAYN3/ihF1cG2doYtDfcldKkqUA3puJG9qoHr56jV/rnBGxvLN8m1lASeJUbot1kpawU/EUNP272f8EUyXkuFH1oYQLAwXgRxFX89aytDtfoa/v9QKWKwLoeXeRXHlMegNW3rmDsR/R5RHcW6yK4XHayUBr1bHgdygH1vVPWOpFs47hNtYnDo5UBFT1Ap1KUDeL57G5dI+ZZ+QCtT2h3xbd6eO+i+aMxvaJDiA+GF1HYfD4C+RhGJDTkcCZqCXMmnA2QIN2SkyHDuE2uYP+MSm5YE495bT5ak7bs+5uMj1bAu64FI2UBYVDsCipKh1bhnbya2kCh4bjbydT+3xWNJmafqlNhBJz5n2SL8IiaWL7+tqXtaaODIATUMTewFiRPc= |
|
.optus.com.au/ | Name: bm_sz Value: B55EF98A0F3E3CCEB9F362CDD09D25B2~YAAQyKwwF4tOzH+EAQAAYN3/ihHNPNRatPWeKk8klQLSt9EF0Ch2fV6RUL0OYgdRiNOYx3GdX0HiaOeQaLlSPgQl1KCqbJn1An1sLXHyyeCZRXw7vb1pT/lq1DhcRrgjxYh9GiWDevy8zZoat3ZP7b4cxbnhwycN3KA36WBbyFoQqhh0j4h9i5oLhFIGoqQlq9TeKkQL0QjWO6YA5VIcGdbjJ+VZhTgobTs3lXZxg5cmvVvNRt9v2WAupDDRdDcXMhVM2eZWn60bsg9BqAitHnbBGgrMZ1WUN8ITuSLg1ZFkBRl8ng==~4604214~4534853 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
hokanchanpur.gov.np
instituteforpr.org
logincdn.msauth.net
platzer-consulting.com
ptm.untirta.ac.id
www.optus.com.au
103.142.195.252
104.17.24.14
13.107.238.59
185.54.208.62
202.45.144.31
23.52.112.183
52.21.113.96
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
6099ca3afb2bad6883021c5aa6941615a9e92428d9936d09c522c371f803cbdc
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
a5232367ded9180403e23b853b02d024dad31f54d972d30ca9ce217f82180508
a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea
aa15e0f857bfa3952300e3468e6b3adee69f4820b7b47e0bd405a8f081de47cf
b2573db4600f3c175152f76642a06fd32ce7383a9faafb3661d75e1205f1cf5b
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4