yukliburan.id
Open in
urlscan Pro
2606:4700:3030::ac43:c257
Malicious Activity!
Public Scan
Effective URL: https://yukliburan.id/index.html?alt=media&token=49e4cd16-181c-4ac3-bd24-dbcc55fdd55f
Submission: On January 19 via manual from CN
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 14th 2020. Valid for: a year.
This is the only time yukliburan.id was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2800:6c0:2::5 2800:6c0:2::5 | 27823 (Dattatec.com) (Dattatec.com) | |
1 | 2606:4700:303... 2606:4700:3030::ac43:c257 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 35.208.100.12 35.208.100.12 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:803::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6810:a723 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:81c::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:809::2003 | 15169 (GOOGLE) (GOOGLE) | |
12 | 8 |
ASN15169 (GOOGLE, US)
PTR: 12.100.208.35.bc.googleusercontent.com
federacionongscr.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
federacionongscr.org
federacionongscr.org |
73 KB |
2 |
gstatic.com
fonts.gstatic.com |
22 KB |
2 |
googleapis.com
fonts.googleapis.com ajax.googleapis.com |
31 KB |
1 |
cloudflare.com
ajax.cloudflare.com |
5 KB |
1 |
yukliburan.id
yukliburan.id |
3 KB |
1 |
gentedeseguridad.com.ar
gentedeseguridad.com.ar |
871 B |
12 | 6 |
Domain | Requested by | |
---|---|---|
5 | federacionongscr.org |
yukliburan.id
ajax.cloudflare.com |
2 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | ajax.googleapis.com |
ajax.cloudflare.com
|
1 | ajax.cloudflare.com |
yukliburan.id
|
1 | fonts.googleapis.com |
yukliburan.id
|
1 | yukliburan.id |
gentedeseguridad.com.ar
|
1 | gentedeseguridad.com.ar | |
12 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-06-14 - 2021-06-14 |
a year | crt.sh |
federacionongscr.org R3 |
2021-01-14 - 2021-04-14 |
3 months | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-12-15 - 2021-03-09 |
3 months | crt.sh |
ajax.cloudflare.com DigiCert ECC Secure Server CA |
2020-08-11 - 2022-08-16 |
2 years | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-12-15 - 2021-03-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://yukliburan.id/index.html?alt=media&token=49e4cd16-181c-4ac3-bd24-dbcc55fdd55f
Frame ID: E26123D74F52AD452B669EA36C7BE8F0
Requests: 13 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://gentedeseguridad.com.ar/index.html Page URL
- https://yukliburan.id/index.html?alt=media&token=49e4cd16-181c-4ac3-bd24-dbcc55fdd55f Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://gentedeseguridad.com.ar/index.html Page URL
- https://yukliburan.id/index.html?alt=media&token=49e4cd16-181c-4ac3-bd24-dbcc55fdd55f Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
index.html
gentedeseguridad.com.ar/ |
1 KB 871 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
index.html
yukliburan.id/ |
8 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
federacionongscr.org/wp-admin/assets/bootstrap/css/ |
157 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
10 KB 899 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.min.css
federacionongscr.org/wp-admin/assets/css/ |
2 KB 870 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rocket-loader.min.js
ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/ |
12 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
884 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.min.js
federacionongscr.org/wp-admin/assets/js/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
federacionongscr.org/wp-admin/assets/bootstrap/js/ |
79 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
federacionongscr.org/wp-admin/assets/js/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| __cfQR object| bootstrap boolean| __cfRLUnblockHandlers1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.yukliburan.id/ | Name: __cfduid Value: d4cad01c51e13f6234f4357ac342bb1ec1611041418 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.cloudflare.com
ajax.googleapis.com
federacionongscr.org
fonts.googleapis.com
fonts.gstatic.com
gentedeseguridad.com.ar
yukliburan.id
2606:4700:3030::ac43:c257
2606:4700::6810:a723
2800:6c0:2::5
2a00:1450:4001:803::200a
2a00:1450:4001:809::2003
2a00:1450:4001:81c::200a
35.208.100.12
0ba5281b6dfcafb6929b71c3c4106daf3d8b3887aee17a896e123075fedc3d13
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f
7b3e10ed2f867fd289acfef86780d8f78ecae39000fed6a0557a3b82b15b57e3
7ba7f6b94246d8a609919f613d8193727b6a1fdc4f8ccf28ff60604841dde059
b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e
b201ae7353df17e958c91ae577b46e9d47c75568f9b7c445f2b2de3e2d8e2759
b4a4bc9bcb9b4687ab0d2439605e8c84fb9bdb3c08813c308a4bc99b8cf3fbec
dab01a35d2def8934212b4ab0ead675991fcc100094bb1ebecbadd52d94ce896
f50010fb3423b3c462b636e5cb4af628c18f7b15f448203a0ef6dcae0df22a6b
f67b782ec5a62c8fcedb89535bcf48cc02ae06a119e3b97fe2b875fad1ff358f
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d