webaccess.co.id Open in urlscan Pro
119.235.28.58 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://webaccess.co.id/~jfsulfur/gl/here/
Submission Tags: phishing malicious Search All
Submission: On November 02 via api (November 2nd 2020, 11:32:35 pm UTC) from US

Summary HTTP 9 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 9 HTTP transactions. The main IP is 119.235.28.58, located in Indonesia and belongs to INET-AS-ID PT. Inet Global Indo, ID. The main domain is webaccess.co.id.

This is the only time webaccess.co.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address		AS Autonomous System
1 8	119.235.28.58 119.235.28.58		24532 (INET-AS-I...) (INET-AS-ID PT. Inet Global Indo)
1	216.158.67.117 216.158.67.117		18450 (WEBNX) (WEBNX)
1	151.101.114.133 151.101.114.133		54113 (FASTLY) (FASTLY)
9	3

8 119.235.28.58 (Indonesia) 1 redirects

ASN24532 (INET-AS-ID PT. Inet Global Indo, ID)

webaccess.co.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.158.67.117 (Los Angeles, United States)

ASN18450 (WEBNX, US)
PTR: 216-158-67-117.static.webnx.com

file.myfontastic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.114.133 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	webaccess.co.id 1 redirects webaccess.co.id	358 KB
1	paypalobjects.com www.paypalobjects.com	47 KB
1	myfontastic.com file.myfontastic.com	2 KB
9	3

	Domain	Requested by
8	webaccess.co.id	1 redirects webaccess.co.id
1	www.paypalobjects.com	webaccess.co.id
1	file.myfontastic.com	webaccess.co.id
9	3

This site contains no links.

Subject Issuer	Validity	Valid
file.myfontastic.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-04` - `2022-11-06`	2 years	crt.sh
www.paypalobjects.com DigiCert SHA2 Extended Validation Server CA	`2019-12-09` - `2021-12-13`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://webaccess.co.id/~jfsulfur/gl/here/
Frame ID: 42251FFC4EF920AAC0D533454B6FB3AD
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://webaccess.co.id/~jfsulfur/gl/here HTTP 301
http://webaccess.co.id/~jfsulfur/gl/here/ Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_ssl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_ssl(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
headers server /mod_ssl(?:\/([\d.]+))?/i

Page Statistics

9
Requests

22 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

406 kB
Transfer

402 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://webaccess.co.id/~jfsulfur/gl/here HTTP 301
http://webaccess.co.id/~jfsulfur/gl/here/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
webaccess.co.id/~jfsulfur/gl/here/
Redirect Chain

http://webaccess.co.id/~jfsulfur/gl/here
http://webaccess.co.id/~jfsulfur/gl/here/

2 KB
2 KB

5365ms
5365ms

Document
text/html

119.235.28.58
INET-AS-ID PT. In...

General

Check archive.org

Show headers Download Go to

Full URL: http://webaccess.co.id/~jfsulfur/gl/here/
Protocol: HTTP/1.1
Server: 119.235.28.58 , Indonesia, ASN24532 (INET-AS-ID PT. Inet Global Indo, ID),
Reverse DNS
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_mono/2.6.3 mod_bwlimited/1.4 PHP/5.4.45 / PHP/5.4.45
Resource Hash: 14912fbeeb04cea1e50072ead2ab6aa139f20a847e5c116622c0fd44276764f7

Request headers

Host: webaccess.co.id
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 02 Nov 2020 23:32:12 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_mono/2.6.3 mod_bwlimited/1.4 PHP/5.4.45
X-Powered-By: PHP/5.4.45
Content-Length: 2023
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html

Redirect headers

Date: Mon, 02 Nov 2020 23:32:12 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_mono/2.6.3 mod_bwlimited/1.4 PHP/5.4.45
Location: http://webaccess.co.id/~jfsulfur/gl/here/
Content-Length: 407
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK ajax.js Show response
webaccess.co.id/~jfsulfur/gl/here/js/ 85 KB
85 KB 396ms
377ms Script
application/javascript 119.235.28.58
INET-AS-ID PT. In...

General

Check archive.org

Show headers Download Go to

Full URL: http://webaccess.co.id/~jfsulfur/gl/here/js/ajax.js
Requested by: Host: webaccess.co.id
URL: http://webaccess.co.id/~jfsulfur/gl/here/
Protocol: HTTP/1.1
Server: 119.235.28.58 , Indonesia, ASN24532 (INET-AS-ID PT. Inet Global Indo, ID),
Reverse DNS
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_mono/2.6.3 mod_bwlimited/1.4 PHP/5.4.45 /
Resource Hash: 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

Referer: http://webaccess.co.id/~jfsulfur/gl/here/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 02 Nov 2020 23:32:18 GMT
Last-Modified: Sat, 25 Feb 2017 12:44:40 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_mono/2.6.3 mod_bwlimited/1.4 PHP/5.4.45
ETag: "329b65-152b5-5495a35ad7e00"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 86709

GET
H/1.1 200
OK jquery.js Show response
webaccess.co.id/~jfsulfur/gl/here/js/ 85 KB
85 KB 394ms
375ms Script
application/javascript 119.235.28.58
INET-AS-ID PT. In...

General

Check archive.org

Show headers Download Go to

Full URL: http://webaccess.co.id/~jfsulfur/gl/here/js/jquery.js
Requested by: Host: webaccess.co.id
URL: http://webaccess.co.id/~jfsulfur/gl/here/
Protocol: HTTP/1.1
Server: 119.235.28.58 , Indonesia, ASN24532 (INET-AS-ID PT. Inet Global Indo, ID),
Reverse DNS
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_mono/2.6.3 mod_bwlimited/1.4 PHP/5.4.45 /
Resource Hash: 1cf30e59d21d4ae560af7143f5913efcc8222bcaa4fcc7508eb802b5faa9e94e

Request headers

Referer: http://webaccess.co.id/~jfsulfur/gl/here/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 02 Nov 2020 23:32:18 GMT
Last-Modified: Sat, 25 Feb 2017 12:44:40 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_mono/2.6.3 mod_bwlimited/1.4 PHP/5.4.45
ETag: "329b69-152b9-5495a35ad7e00"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 86713

GET
H/1.1 200
OK jquery.min.js Show response
webaccess.co.id/~jfsulfur/gl/here/js/ 85 KB
85 KB 390ms
372ms Script
application/javascript 119.235.28.58
INET-AS-ID PT. In...

General

Check archive.org

Show headers Download Go to

Full URL: http://webaccess.co.id/~jfsulfur/gl/here/js/jquery.min.js
Requested by: Host: webaccess.co.id
URL: http://webaccess.co.id/~jfsulfur/gl/here/
Protocol: HTTP/1.1
Server: 119.235.28.58 , Indonesia, ASN24532 (INET-AS-ID PT. Inet Global Indo, ID),
Reverse DNS
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_mono/2.6.3 mod_bwlimited/1.4 PHP/5.4.45 /
Resource Hash: 1cf30e59d21d4ae560af7143f5913efcc8222bcaa4fcc7508eb802b5faa9e94e

Request headers

Referer: http://webaccess.co.id/~jfsulfur/gl/here/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 02 Nov 2020 23:32:18 GMT
Last-Modified: Sat, 25 Feb 2017 12:44:40 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_mono/2.6.3 mod_bwlimited/1.4 PHP/5.4.45
ETag: "329b6a-152b9-5495a35ad7e00"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 86713

GET
H/1.1 200
OK js-plus.js Show response
webaccess.co.id/~jfsulfur/gl/here/js/ 19 KB
20 KB 395ms
377ms Script
application/javascript 119.235.28.58
INET-AS-ID PT. In...

General

Check archive.org

Show headers Download Go to

Full URL: http://webaccess.co.id/~jfsulfur/gl/here/js/js-plus.js
Requested by: Host: webaccess.co.id
URL: http://webaccess.co.id/~jfsulfur/gl/here/
Protocol: HTTP/1.1
Server: 119.235.28.58 , Indonesia, ASN24532 (INET-AS-ID PT. Inet Global Indo, ID),
Reverse DNS
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_mono/2.6.3 mod_bwlimited/1.4 PHP/5.4.45 /
Resource Hash: 6db7f8b3ee22247ae32d90069cadb075a0ab139680eb0cfb82e31064955393ff

Request headers

Referer: http://webaccess.co.id/~jfsulfur/gl/here/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 02 Nov 2020 23:32:18 GMT
Last-Modified: Sat, 04 Mar 2017 18:09:48 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_mono/2.6.3 mod_bwlimited/1.4 PHP/5.4.45
ETag: "329b6b-4cc9-549eb91559300"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 19657

GET
H/1.1 200
OK styles.css
webaccess.co.id/~jfsulfur/gl/here/css/ 6 KB
6 KB 199ms
197ms Stylesheet
text/css 119.235.28.58
INET-AS-ID PT. In...

General

Check archive.org

Show headers Download Go to

Full URL: http://webaccess.co.id/~jfsulfur/gl/here/css/styles.css
Requested by: Host: webaccess.co.id
URL: http://webaccess.co.id/~jfsulfur/gl/here/
Protocol: HTTP/1.1
Server: 119.235.28.58 , Indonesia, ASN24532 (INET-AS-ID PT. Inet Global Indo, ID),
Reverse DNS
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_mono/2.6.3 mod_bwlimited/1.4 PHP/5.4.45 /
Resource Hash: 5011d5b32b22761a13ebc98b5da6ddf388ce658f70f1a0a10131c02cefbbbea1

Request headers

Referer: http://webaccess.co.id/~jfsulfur/gl/here/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 02 Nov 2020 23:32:18 GMT
Last-Modified: Sun, 26 Feb 2017 14:30:30 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_mono/2.6.3 mod_bwlimited/1.4 PHP/5.4.45
ETag: "329b52-1852-5496fce022d80"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 6226

GET
H/1.1 200
OK icons.css
file.myfontastic.com/hSMyDca9BDwBA8GgvxRZRP/ 2 KB
2 KB 469ms
152ms Stylesheet
text/css 216.158.67.117
WEBNX

General

Check archive.org

Show headers Download Go to

Full URL: https://file.myfontastic.com/hSMyDca9BDwBA8GgvxRZRP/icons.css
Requested by: Host: webaccess.co.id
URL: http://webaccess.co.id/~jfsulfur/gl/here/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.158.67.117 Los Angeles, United States, ASN18450 (WEBNX, US),
Reverse DNS: 216-158-67-117.static.webnx.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 9ddf4cbc60e5fb2a918d50bdbfc10e7bd9e7d7a7ecfbaa871dd75b128253b014

Request headers

Referer: http://webaccess.co.id/~jfsulfur/gl/here/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 02 Nov 2020 23:32:18 GMT
Last-Modified: Sun, 26 Feb 2017 13:13:28 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "58b2d478-635"
Content-Type: text/css
Cache-Control: no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1589

GET
H/1.1 200
OK logo.png
webaccess.co.id/~jfsulfur/gl/here/css/ 73 KB
74 KB 195ms
195ms Image
image/png 119.235.28.58
INET-AS-ID PT. In...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://webaccess.co.id/~jfsulfur/gl/here/css/logo.png
Requested by: Host: webaccess.co.id
URL: http://webaccess.co.id/~jfsulfur/gl/here/
Protocol: HTTP/1.1
Server: 119.235.28.58 , Indonesia, ASN24532 (INET-AS-ID PT. Inet Global Indo, ID),
Reverse DNS
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_mono/2.6.3 mod_bwlimited/1.4 PHP/5.4.45 /
Resource Hash: 015c1b9d9d8a362f4f6c1e542f0b8d9e9f662bef7bc819ee948cdece297164a4

Request headers

Referer: http://webaccess.co.id/~jfsulfur/gl/here/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 02 Nov 2020 23:32:19 GMT
Last-Modified: Sat, 25 Feb 2017 12:44:40 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_mono/2.6.3 mod_bwlimited/1.4 PHP/5.4.45
ETag: "329b51-1256a-5495a35ad7e00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 75114

GET
H2 200 PayPalSansSmall-Regular.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ 46 KB
47 KB 148ms
31ms Font
application/x-font-woff 151.101.114.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansSmall-Regular.woff

Requested by

Host: webaccess.co.id
URL: http://webaccess.co.id/~jfsulfur/gl/here/css/styles.css

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Apache /

Resource Hash

ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff

Request headers

Origin: http://webaccess.co.id
Referer: http://webaccess.co.id/~jfsulfur/gl/here/css/styles.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 02 Nov 2020 23:32:19 GMT
x-pad: avoid browser bug
x-content-type-options: nosniff
age: 20895308
x-cache: HIT, HIT, HIT
status: 200
content-length: 47339
x-served-by: cache-sjc10021-SJC, cache-lax8620-LAX, cache-hhn4065-HHN
access-control-allow-origin: *
last-modified: Wed, 30 Sep 2015 05:09:04 GMT
server: Apache
x-timer: S1604359939.198568,VS0,VE0
strict-transport-security: max-age=31557600
content-type: application/x-font-woff
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
cache-control: max-age=3600
accept-ranges: bytes
x-cache-hits: 1, 1, 289687

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

file.myfontastic.com
webaccess.co.id
www.paypalobjects.com
119.235.28.58
151.101.114.133
216.158.67.117
015c1b9d9d8a362f4f6c1e542f0b8d9e9f662bef7bc819ee948cdece297164a4
14912fbeeb04cea1e50072ead2ab6aa139f20a847e5c116622c0fd44276764f7
1cf30e59d21d4ae560af7143f5913efcc8222bcaa4fcc7508eb802b5faa9e94e
5011d5b32b22761a13ebc98b5da6ddf388ce658f70f1a0a10131c02cefbbbea1
6db7f8b3ee22247ae32d90069cadb075a0ab139680eb0cfb82e31064955393ff
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
9ddf4cbc60e5fb2a918d50bdbfc10e7bd9e7d7a7ecfbaa871dd75b128253b014
ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8