ssl-css-accessref.maxweb.id Open in urlscan Pro
103.146.203.15 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://tx.reb.gv.uk.j2zm.laughteryogalady.ir/.qzq/.zqz/?4HGHLXeD794M
Effective URL:
https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true
Submission: On September 02 via manual (September 2nd 2024, 9:50:25 am UTC) from DE — Scanned from GB

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 13 HTTP transactions. The main IP is 103.146.203.15, located in Indonesia and belongs to IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID. The main domain is ssl-css-accessref.maxweb.id.
TLS certificate: Issued by R11 on August 12th 2024. Valid for: 3 months.

This is the only time ssl-css-accessref.maxweb.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UK Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
2 2	185.18.213.235 185.18.213.235	48715 (SEFROYEKP...) (SEFROYEKPARDAZENG-AS Sefroyek Pardaz Engineering Company)
1	103.90.232.99 103.90.232.99	135917 (WEBPANDA-...) (WEBPANDA-AS-VN Cong ty TNHH Web Panda)
1 13	103.146.203.15 103.146.203.15	136052 (IDNIC-IDC...) (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia)
13	3

2 185.18.213.235 (Iran, Islamic Republic Of) 2 redirects

ASN48715 (SEFROYEKPARDAZENG-AS Sefroyek Pardaz Engineering Company, IR)
PTR: cp40.tavanahost.com

tx.reb.gv.uk.j2zm.laughteryogalady.ir	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 103.90.232.99 (Viet Nam)

ASN135917 (WEBPANDA-AS-VN Cong ty TNHH Web Panda, VN)

phukiennam.vn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 103.146.203.15 (Indonesia) 1 redirects

ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID)
PTR: iix15.cloudhost.id

ssl-css-accessref.maxweb.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	maxweb.id 1 redirects ssl-css-accessref.maxweb.id	369 KB
2	laughteryogalady.ir 2 redirects tx.reb.gv.uk.j2zm.laughteryogalady.ir	693 B
1	phukiennam.vn phukiennam.vn	382 B
13	3

	Domain	Requested by
13	ssl-css-accessref.maxweb.id	1 redirects phukiennam.vn ssl-css-accessref.maxweb.id
2	tx.reb.gv.uk.j2zm.laughteryogalady.ir	2 redirects
1	phukiennam.vn
13	3

This site contains no links.

Subject Issuer	Validity	Valid
phukiennam.vn R11	`2024-08-29` - `2024-11-27`	3 months	crt.sh
www.ssl-css-accessref.maxweb.id R11	`2024-08-12` - `2024-11-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true
Frame ID: 5114B97E0311D94F487EC11A333DD84F
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Enter Your Name And Address

Page URL History Show full URLs

http://tx.reb.gv.uk.j2zm.laughteryogalady.ir/.qzq/.zqz/?4HGHLXeD794M HTTP 307
https://tx.reb.gv.uk.j2zm.laughteryogalady.ir/.qzq/.zqz/?4HGHLXeD794M HTTP 302
https://phukiennam.vn/.wp-cli/?sessionid=6170c11818077255792af82878942709&securessl=true HTTP 307
http://tx.reb.gv.uk.j2zm.laughteryogalady.ir/.qzq/.zqz/?4HGHLXeD794M HTTP 302
https://phukiennam.vn/.wp-cli/?sessionid=6170c11818077255792af82878942709&securessl=true Page URL
https://ssl-css-accessref.maxweb.id/62/44/01/05/68/?sessionid=6170c11818077255792af82878942709&securessl=true HTTP 302
https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&secures... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

GOV.UK Template (UI frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+govuk-template[^>"]+css
<link[^>]+govuk-template-print[^>"]+css
<link[^>]+govuk-template-ie6[^>"]+css
<link[^>]+govuk-template-ie7[^>"]+css
<link[^>]+govuk-template-ie8[^>"]+css

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

534 kB
Transfer

1017 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://tx.reb.gv.uk.j2zm.laughteryogalady.ir/.qzq/.zqz/?4HGHLXeD794M HTTP 307
https://tx.reb.gv.uk.j2zm.laughteryogalady.ir/.qzq/.zqz/?4HGHLXeD794M HTTP 302
https://phukiennam.vn/.wp-cli/?sessionid=6170c11818077255792af82878942709&securessl=true HTTP 307
http://tx.reb.gv.uk.j2zm.laughteryogalady.ir/.qzq/.zqz/?4HGHLXeD794M HTTP 302
https://phukiennam.vn/.wp-cli/?sessionid=6170c11818077255792af82878942709&securessl=true Page URL
https://ssl-css-accessref.maxweb.id/62/44/01/05/68/?sessionid=6170c11818077255792af82878942709&securessl=true HTTP 302
https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://tx.reb.gv.uk.j2zm.laughteryogalady.ir/.qzq/.zqz/?4HGHLXeD794M HTTP 307
https://tx.reb.gv.uk.j2zm.laughteryogalady.ir/.qzq/.zqz/?4HGHLXeD794M HTTP 302
https://phukiennam.vn/.wp-cli/?sessionid=6170c11818077255792af82878942709&securessl=true HTTP 307
http://tx.reb.gv.uk.j2zm.laughteryogalady.ir/.qzq/.zqz/?4HGHLXeD794M HTTP 302
https://phukiennam.vn/.wp-cli/?sessionid=6170c11818077255792af82878942709&securessl=true

13 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/
phukiennam.vn/.wp-cli/
Redirect Chain

http://tx.reb.gv.uk.j2zm.laughteryogalady.ir/.qzq/.zqz/?4HGHLXeD794M
https://tx.reb.gv.uk.j2zm.laughteryogalady.ir/.qzq/.zqz/?4HGHLXeD794M
https://phukiennam.vn/.wp-cli/?sessionid=6170c11818077255792af82878942709&securessl=true
http://tx.reb.gv.uk.j2zm.laughteryogalady.ir/.qzq/.zqz/?4HGHLXeD794M
https://phukiennam.vn/.wp-cli/?sessionid=6170c11818077255792af82878942709&securessl=true

175 B
382 B

3847ms
1213ms

Document
text/html

103.90.232.99
WEBPANDA-AS-VN Co...

General

Check archive.org

Show headers Download Go to

Full URL: https://phukiennam.vn/.wp-cli/?sessionid=6170c11818077255792af82878942709&securessl=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.90.232.99 , Viet Nam, ASN135917 (WEBPANDA-AS-VN Cong ty TNHH Web Panda, VN),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Mon, 02 Sep 2024 09:50:25 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Transfer-Encoding: chunked

Redirect headers

Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 02 Sep 2024 09:50:06 GMT
location: https://phukiennam.vn/.wp-cli/?sessionid=6170c11818077255792af82878942709&securessl=true
x-powered-by: PHP/8.2.20

GET
H2

200

Primary Request start.php Show response
ssl-css-accessref.maxweb.id/62/44/01/05/68/
Redirect Chain

https://ssl-css-accessref.maxweb.id/62/44/01/05/68/?sessionid=6170c11818077255792af82878942709&securessl=true
https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true

9 KB
3 KB

1202ms
1200ms

Document
text/html

103.146.203.15
IDNIC-IDCLOUDHOST...

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true

Requested by

Host: phukiennam.vn
URL: https://phukiennam.vn/.wp-cli/?sessionid=6170c11818077255792af82878942709&securessl=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

103.146.203.15 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),

Reverse DNS

iix15.cloudhost.id

Software

LiteSpeed / PHP/7.4.33

Resource Hash

bc101fc09aaca524fbb472b12cb4878be59fdd648379f85cd7beed262c8bb210

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://phukiennam.vn/.wp-cli/?sessionid=6170c11818077255792af82878942709&securessl=true
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-length: 2913
content-type: text/html; charset=UTF-8
date: Mon, 02 Sep 2024 09:50:17 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: LiteSpeed
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-powered-by: PHP/7.4.33

Redirect headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 02 Sep 2024 09:50:16 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: start.php?&sessionid=6170c11818077255792af82878942709&securessl=true
pragma: no-cache
server: LiteSpeed
strict-transport-security: max-age=31536000
x-powered-by: PHP/7.4.33

GET
H3 200 jquery.min.js Show response
ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/ 82 KB
28 KB 310ms
297ms Script
application/javascript 103.146.203.15
IDNIC-IDCLOUDHOST...

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/jquery.min.js

Requested by

Host: ssl-css-accessref.maxweb.id
URL: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true

Protocol

Security

QUIC, , AES_128_GCM

Server

103.146.203.15 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),

Reverse DNS

iix15.cloudhost.id

Software

LiteSpeed /

Resource Hash

874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

date: Mon, 02 Sep 2024 09:50:18 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Aug 2024 17:31:47 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 28763
expires: Mon, 09 Sep 2024 09:50:18 GMT

GET
H3 200 govuk-template.css
ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/ 20 KB
4 KB 345ms
326ms Stylesheet
text/css 103.146.203.15
IDNIC-IDCLOUDHOST...

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/govuk-template.css

Requested by

Host: ssl-css-accessref.maxweb.id
URL: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true

Protocol

Security

QUIC, , AES_128_GCM

Server

103.146.203.15 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),

Reverse DNS

iix15.cloudhost.id

Software

LiteSpeed /

Resource Hash

13aa82ee00bd9d59269c252d580447fd09dfcc71fbf7e0fe929d598c509bf79e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

date: Mon, 02 Sep 2024 09:50:18 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Aug 2024 17:31:47 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 4074
expires: Mon, 09 Sep 2024 09:50:18 GMT

GET
H3 200 fonts.css
ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/ 267 KB
197 KB 350ms
322ms Stylesheet
text/css 103.146.203.15
IDNIC-IDCLOUDHOST...

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/fonts.css

Requested by

Host: ssl-css-accessref.maxweb.id
URL: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true

Protocol

Security

QUIC, , AES_128_GCM

Server

103.146.203.15 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),

Reverse DNS

iix15.cloudhost.id

Software

LiteSpeed /

Resource Hash

6813a04aa7ebe09726eda5fdd9c4abf1c5f151335adf0ad90474a5fe316e87ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

date: Mon, 02 Sep 2024 09:50:18 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Aug 2024 17:31:47 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 201094
expires: Mon, 09 Sep 2024 09:50:18 GMT

GET
H3 200 application.min.css
ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/ 178 KB
38 KB 1167ms
1141ms Stylesheet
text/css 103.146.203.15
IDNIC-IDCLOUDHOST...

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/application.min.css

Requested by

Host: ssl-css-accessref.maxweb.id
URL: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true

Protocol

Security

QUIC, , AES_128_GCM

Server

103.146.203.15 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),

Reverse DNS

iix15.cloudhost.id

Software

LiteSpeed /

Resource Hash

ab3a0f463d776896fd738585a03a21c34f591f138df27815a0eda176fc42bad6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

date: Mon, 02 Sep 2024 09:50:18 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Aug 2024 17:31:47 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 38570
expires: Mon, 09 Sep 2024 09:50:18 GMT

GET
H3 200 gov.uk_logotype_crown.png
ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/ 780 B
801 B 1495ms
1470ms Image
image/png 103.146.203.15
IDNIC-IDCLOUDHOST...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/gov.uk_logotype_crown.png

Requested by

Host: ssl-css-accessref.maxweb.id
URL: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true

Protocol

Security

QUIC, , AES_128_GCM

Server

103.146.203.15 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),

Reverse DNS

iix15.cloudhost.id

Software

LiteSpeed /

Resource Hash

14b98db97bbd6cb1f33935d3e0d973fa68ca0c38fb5762b033423ceffe9e16f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

date: Mon, 02 Sep 2024 09:50:18 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Aug 2024 17:31:47 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 780
expires: Mon, 09 Sep 2024 09:50:18 GMT

GET
H3 200 open-government-licence_2x.png
ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/ 504 B
525 B 1490ms
1470ms Image
image/png 103.146.203.15
IDNIC-IDCLOUDHOST...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/open-government-licence_2x.png

Requested by

Host: ssl-css-accessref.maxweb.id
URL: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true

Protocol

Security

QUIC, , AES_128_GCM

Server

103.146.203.15 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),

Reverse DNS

iix15.cloudhost.id

Software

LiteSpeed /

Resource Hash

2dcbca9026a39b5e4cc536b2f842bd173148b018c7ce369a5930558f4de0e23b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

date: Mon, 02 Sep 2024 09:50:18 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Aug 2024 17:31:47 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 504
expires: Mon, 09 Sep 2024 09:50:18 GMT

GET
H3 200 application.min.js Show response
ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/ 288 KB
91 KB 1110ms
1110ms Script
application/javascript 103.146.203.15
IDNIC-IDCLOUDHOST...

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/application.min.js

Requested by

Host: ssl-css-accessref.maxweb.id
URL: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true

Protocol

Security

QUIC, , AES_128_GCM

Server

103.146.203.15 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),

Reverse DNS

iix15.cloudhost.id

Software

LiteSpeed /

Resource Hash

b1ba9b0ff9669b7ffd38f4c96d42441573db020edcd45d46f4468d76f1ccf40f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

date: Mon, 02 Sep 2024 09:50:18 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Aug 2024 17:31:47 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 93503
expires: Mon, 09 Sep 2024 09:50:18 GMT

GET
H3 200 govuk-template-print.css
ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/ 1 KB
585 B 870ms
869ms Stylesheet
text/css 103.146.203.15
IDNIC-IDCLOUDHOST...

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/govuk-template-print.css

Requested by

Host: ssl-css-accessref.maxweb.id
URL: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true

Protocol

Security

QUIC, , AES_128_GCM

Server

103.146.203.15 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),

Reverse DNS

iix15.cloudhost.id

Software

LiteSpeed /

Resource Hash

5bb990686d6668df3f9d5208b10fa83d2f5d55820b442be13542a3dfbd3e361a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

date: Mon, 02 Sep 2024 09:50:18 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Aug 2024 17:31:47 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 562
expires: Mon, 09 Sep 2024 09:50:18 GMT

GET
H3 200 hmrc_crest_18px.png
ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/ 2 KB
2 KB 292ms
289ms Image
image/png 103.146.203.15
IDNIC-IDCLOUDHOST...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/hmrc_crest_18px.png

Requested by

Host: ssl-css-accessref.maxweb.id
URL: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/application.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

103.146.203.15 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),

Reverse DNS

iix15.cloudhost.id

Software

LiteSpeed /

Resource Hash

c208f82493fb15f9261ba474cf6615ddc22e51984177095c4d12d2ad39647ca9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/application.min.css
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

date: Mon, 02 Sep 2024 09:50:19 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Aug 2024 17:31:47 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 1637
expires: Mon, 09 Sep 2024 09:50:19 GMT

GET
H3 200 govuk-crest.png
ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/ 4 KB
4 KB 297ms
295ms Image
image/png 103.146.203.15
IDNIC-IDCLOUDHOST...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/govuk-crest.png

Requested by

Host: ssl-css-accessref.maxweb.id
URL: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/govuk-template.css

Protocol

Security

QUIC, , AES_128_GCM

Server

103.146.203.15 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),

Reverse DNS

iix15.cloudhost.id

Software

LiteSpeed /

Resource Hash

bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/govuk-template.css
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

date: Mon, 02 Sep 2024 09:50:19 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Aug 2024 17:31:47 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 3584
expires: Mon, 09 Sep 2024 09:50:19 GMT

GET
DATA 200
OK truncated
/ 94 KB
94 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30

Request headers

Referer
Origin: https://ssl-css-accessref.maxweb.id
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ 71 KB
71 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba

Request headers

Referer
Origin: https://ssl-css-accessref.maxweb.id
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

Content-Type: application/font-woff

GET
H3 200 favicon.ico
ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/ 318 B
397 B 293ms
293ms Other
image/x-icon 103.146.203.15
IDNIC-IDCLOUDHOST...

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl-css-accessref.maxweb.id/62/44/01/05/68/step1_files/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

103.146.203.15 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),

Reverse DNS

iix15.cloudhost.id

Software

LiteSpeed /

Resource Hash

8332332d0e75065404a4180f03f52c6a8552024a14f3a9809e08d47e270c784f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ssl-css-accessref.maxweb.id/62/44/01/05/68/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

date: Mon, 02 Sep 2024 09:50:20 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Aug 2024 17:31:47 GMT
server: LiteSpeed
content-type: image/x-icon
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 318
expires: Mon, 09 Sep 2024 09:50:20 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UK Government (Government)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ssl-css-accessref.maxweb.id/	1969-12-31 23:59:59	Name: PHPSESSID Value: 8fa99852445cc90e08904c9a6a828e09
			.maxweb.id/	1969-12-31 23:59:59	Name: mdtpdf Value: eyJ2ZXJzaW9uIjoxLCJ1c2VyQWdlbnQiOiJNb3ppbGxhLzUuMCAoTGludXg7IEFuZHJvaWQgMTA7IEspIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjguMC42NjEzLjg4IE1vYmlsZSBTYWZhcmkvNTM3LjM2IiwibGFuZ3VhZ2UiOiJlbi1HQiIsImNvbG9yRGVwdGgiOjI0LCJyZXNvbHV0aW9uIjoiMTIwMHgxNjAwIiwidGltZXpvbmUiOi02MCwiY2xpZW50U2lkZVRpbWVzdGFtcCI6MTcyNTI3MDYxODcwMSwic2Vzc2lvblN0b3JhZ2UiOnRydWUsImxvY2FsU3RvcmFnZSI6dHJ1ZSwiaW5kZXhlZERCIjp0cnVlLCJwbGF0Zm9ybSI6IkxpbnV4IHg4Nl82NCIsImRvTm90VHJhY2siOmZhbHNlLCJudW1iZXJPZlBsdWdpbnMiOjUsInBsdWdpbnMiOlsiUERGIFZpZXdlciIsIkNocm9tZSBQREYgVmlld2VyIiwiQ2hyb21pdW0gUERGIFZpZXdlciIsIk1pY3Jvc29mdCBFZGdlIFBERiBWaWV3ZXIiLCJXZWJLaXQgYnVpbHQtaW4gUERGIl19

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

phukiennam.vn
ssl-css-accessref.maxweb.id
tx.reb.gv.uk.j2zm.laughteryogalady.ir
103.146.203.15
103.90.232.99
185.18.213.235
01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba
048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30
13aa82ee00bd9d59269c252d580447fd09dfcc71fbf7e0fe929d598c509bf79e
14b98db97bbd6cb1f33935d3e0d973fa68ca0c38fb5762b033423ceffe9e16f6
2dcbca9026a39b5e4cc536b2f842bd173148b018c7ce369a5930558f4de0e23b
5bb990686d6668df3f9d5208b10fa83d2f5d55820b442be13542a3dfbd3e361a
6813a04aa7ebe09726eda5fdd9c4abf1c5f151335adf0ad90474a5fe316e87ed
8332332d0e75065404a4180f03f52c6a8552024a14f3a9809e08d47e270c784f
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4
ab3a0f463d776896fd738585a03a21c34f591f138df27815a0eda176fc42bad6
b1ba9b0ff9669b7ffd38f4c96d42441573db020edcd45d46f4468d76f1ccf40f
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b
bc101fc09aaca524fbb472b12cb4878be59fdd648379f85cd7beed262c8bb210
c208f82493fb15f9261ba474cf6615ddc22e51984177095c4d12d2ad39647ca9

ssl-css-accessref.maxweb.id Open in urlscan Pro 103.146.203.15 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

534 kBTransfer

1017 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

2 Cookies

Indicators

ssl-css-accessref.maxweb.id Open in urlscan Pro
103.146.203.15 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

534 kB
Transfer

1017 kB
Size

2
Cookies

13 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!