dev.klinikmatanusantara.com Open in urlscan Pro
117.54.5.10  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request websrc Show response dev.klinikmatanusantara.com/log-au/mpp/signin/a961/	10 KB 4 KB	908ms 489ms	Document text/html	117.54.5.10 INDONET-AS-AP IND...
General Check archive.org Show headers Download Go to Full URL https://dev.klinikmatanusantara.com/log-au/mpp/signin/a961/websrc Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 117.54.5.10 Jakarta, Indonesia, ASN9340 (INDONET-AS-AP INDO Internet, PT, ID), Reverse DNS ezw01-outboundmail.oncloud.co.id Software Apache / Resource Hash 52a869c83e666b2e0bb71551c7bc6397e798b25942f780dd5151a6b7c08bc575 Request headers Host dev.klinikmatanusantara.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 26 Feb 2021 18:59:36 GMT Server Apache Cache-Control max-age=0, public Expires Fri, 26 Feb 2021 18:59:36 GMT Vary Accept-Encoding,User-Agent Content-Encoding gzip Content-Length 3736 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H2	200	app.css www.paypalobjects.com/web/res/882/f03ec0b55ee153b469c844decd2ff/css/	31 KB 6 KB	174ms 53ms	Stylesheet text/css	151.101.114.133 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/web/res/882/f03ec0b55ee153b469c844decd2ff/css/app.css Requested by Host: dev.klinikmatanusantara.com URL: https://dev.klinikmatanusantara.com/log-au/mpp/signin/a961/websrc Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash a3195c32223d26b58679477a416061d223424f839d9a8f41dc82c4d9fee25a59 Security Headers Name Value Strict-Transport-Security max-age=31557600 X-Content-Type-Options nosniff Request headers Referer https://dev.klinikmatanusantara.com/log-au/mpp/signin/a961/websrc User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 26 Feb 2021 18:46:19 GMT content-encoding gzip x-content-type-options nosniff age 8402097 x-cache HIT, HIT paypal-debug-id d75316bbd4a90 x-cache-hits 1, 1 dc ccg11-origin-www-1.paypal.com vary Accept-Encoding content-length 5926 via 1.1 varnish, 1.1 varnish x-served-by cache-sjc10054-SJC, cache-hhn4073-HHN last-modified Thu, 18 Jun 2015 03:00:06 GMT x-timer S1614365180.614795,VS0,VE1 etag W/"55823436-7b95" strict-transport-security max-age=31557600 access-control-allow-methods GET content-type text/css access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes expires Sun, 21 Nov 2021 12:45:06 GMT
GET H2	200	modernizr-2.6.1.js Show response www.paypalobjects.com/web/res/882/f03ec0b55ee153b469c844decd2ff/js/lib/	4 KB 2 KB	210ms 90ms	Script application/javascript	151.101.114.133 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/web/res/882/f03ec0b55ee153b469c844decd2ff/js/lib/modernizr-2.6.1.js Requested by Host: dev.klinikmatanusantara.com URL: https://dev.klinikmatanusantara.com/log-au/mpp/signin/a961/websrc Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44 Security Headers Name Value Strict-Transport-Security max-age=31557600 X-Content-Type-Options nosniff Request headers Referer https://dev.klinikmatanusantara.com/log-au/mpp/signin/a961/websrc User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 26 Feb 2021 18:46:19 GMT content-encoding gzip x-content-type-options nosniff age 1280062 x-cache HIT, HIT paypal-debug-id 3054902e9eb10 x-cache-hits 1, 1 dc slc-b-origin-www-2.paypal.com vary Accept-Encoding content-length 1788 via 1.1 varnish, 1.1 varnish x-served-by cache-sjc10037-SJC, cache-hhn4073-HHN last-modified Thu, 18 Jun 2015 03:00:06 GMT x-timer S1614365180.615039,VS0,VE1 etag W/"55823436-edf" strict-transport-security max-age=31557600 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes access-control-allow-headers x-csrf-token expires Fri, 11 Feb 2022 23:04:14 GMT
GET H2	200	require.js Show response www.paypalobjects.com/web/res/882/f03ec0b55ee153b469c844decd2ff/js/lib/	15 KB 6 KB	152ms 31ms	Script application/javascript	151.101.114.133 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/web/res/882/f03ec0b55ee153b469c844decd2ff/js/lib/require.js Requested by Host: dev.klinikmatanusantara.com URL: https://dev.klinikmatanusantara.com/log-au/mpp/signin/a961/websrc Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash c007d73792ac2d25882bfbb573e700e721a0adacfab947e6a0b64a61991fecf0 Security Headers Name Value Strict-Transport-Security max-age=31557600 X-Content-Type-Options nosniff Request headers Referer https://dev.klinikmatanusantara.com/log-au/mpp/signin/a961/websrc User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 26 Feb 2021 18:46:19 GMT content-encoding gzip x-content-type-options nosniff age 149977 x-cache HIT, HIT paypal-debug-id ae17e89808925 x-cache-hits 1, 1 dc ccg11-origin-www-3.paypal.com vary Accept-Encoding content-length 6022 via 1.1 varnish, 1.1 varnish x-served-by cache-sjc10079-SJC, cache-hhn4073-HHN last-modified Thu, 18 Jun 2015 03:00:06 GMT x-timer S1614365180.614787,VS0,VE1 etag W/"55823436-3a06" strict-transport-security max-age=31557600 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes access-control-allow-headers x-csrf-token expires Fri, 25 Feb 2022 00:56:42 GMT
GET H2	200	app.js Show response www.paypalobjects.com/web/res/882/f03ec0b55ee153b469c844decd2ff/js/	284 KB 88 KB	187ms 67ms	Script application/javascript	151.101.114.133 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/web/res/882/f03ec0b55ee153b469c844decd2ff/js/app.js Requested by Host: dev.klinikmatanusantara.com URL: https://dev.klinikmatanusantara.com/log-au/mpp/signin/a961/websrc Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 8ccea9cb8f9aa73d4f0c1666edb87685b74ffa482059caa0ae688646801a4392 Security Headers Name Value Strict-Transport-Security max-age=31557600 X-Content-Type-Options nosniff Request headers Referer https://dev.klinikmatanusantara.com/log-au/mpp/signin/a961/websrc User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 26 Feb 2021 18:46:19 GMT content-encoding gzip x-content-type-options nosniff age 2466149 x-cache HIT, HIT paypal-debug-id b8e40bac0e213 x-cache-hits 1, 1 dc ccg11-origin-www-3.paypal.com vary Accept-Encoding content-length 90045 via 1.1 varnish, 1.1 varnish x-served-by cache-sjc10042-SJC, cache-hhn4073-HHN last-modified Thu, 18 Jun 2015 03:00:06 GMT x-timer S1614365180.614759,VS0,VE1 etag W/"55823436-46f15" strict-transport-security max-age=31557600 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes access-control-allow-headers x-csrf-token expires Sat, 29 Jan 2022 05:35:39 GMT
GET H2	200	pp_jscode_080706.js Show response www.paypalobjects.com/js/site_catalyst/	60 KB 23 KB	176ms 56ms	Script application/javascript	151.101.114.133 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/js/site_catalyst/pp_jscode_080706.js Requested by Host: dev.klinikmatanusantara.com URL: https://dev.klinikmatanusantara.com/log-au/mpp/signin/a961/websrc Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 18c9428f5ed837e027c6fcf29afe9d1f63a1e1e5b53ee1dc6373cf1cd1ea22aa Security Headers Name Value Strict-Transport-Security max-age=31557600 X-Content-Type-Options nosniff Request headers Referer https://dev.klinikmatanusantara.com/log-au/mpp/signin/a961/websrc User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 26 Feb 2021 18:46:19 GMT content-encoding gzip x-content-type-options nosniff age 1323751 x-cache HIT, HIT paypal-debug-id ea82567116a14 dc phx-origin-www-2.paypal.com vary Accept-Encoding content-length 22997 via 1.1 varnish, 1.1 varnish x-served-by cache-sjc10020-SJC, cache-hhn4073-HHN last-modified Thu, 01 Oct 2020 22:14:12 GMT x-timer S1614365180.614758,VS0,VE1 etag W/"5f7654b4-ef25" strict-transport-security max-age=31557600 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control public,max-age=3600 accept-ranges bytes access-control-allow-headers x-csrf-token x-cache-hits 1, 1
GET H2	200	pa.js Show response www.paypalobjects.com/pa/js/	52 KB 20 KB	151ms 31ms	Script application/javascript	151.101.114.133 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/pa/js/pa.js Requested by Host: dev.klinikmatanusantara.com URL: https://dev.klinikmatanusantara.com/log-au/mpp/signin/a961/websrc Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 0eb22afbab03bbbd8a47d4fc5361ff7518a77273e99fd0b73e235c93dd6ea7aa Security Headers Name Value Strict-Transport-Security max-age=31557600 X-Content-Type-Options nosniff Request headers Referer https://dev.klinikmatanusantara.com/log-au/mpp/signin/a961/websrc User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 26 Feb 2021 18:46:19 GMT content-encoding gzip x-content-type-options nosniff age 733146 x-cache HIT, HIT paypal-debug-id 5fd98c5ead0b8 dc slc-b-origin-www-1.paypal.com vary Accept-Encoding content-length 20130 via 1.1 varnish, 1.1 varnish x-served-by cache-sjc10039-SJC, cache-hhn4073-HHN last-modified Thu, 18 Feb 2021 06:57:36 GMT x-timer S1614365180.615129,VS0,VE0 etag W/"602e0fe0-cfcb" strict-transport-security max-age=31557600 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control public,max-age=3600 accept-ranges bytes access-control-allow-headers x-csrf-token x-cache-hits 15805, 103
GET H2	200	paypal-logo-129x32.svg www.paypalobjects.com/images/shared/	5 KB 2 KB	30ms 29ms	Image image/svg+xml	151.101.114.133 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.paypalobjects.com/images/shared/paypal-logo-129x32.svg Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/web/res/882/f03ec0b55ee153b469c844decd2ff/css/app.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software Apache / Resource Hash b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5 Security Headers Name Value Strict-Transport-Security max-age=31557600 X-Content-Type-Options nosniff Request headers Referer https://www.paypalobjects.com/web/res/882/f03ec0b55ee153b469c844decd2ff/css/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 26 Feb 2021 18:46:19 GMT via 1.1 varnish, 1.1 varnish, 1.1 varnish x-content-type-options nosniff age 29632362 x-cache HIT, HIT, HIT surrorage-key /images/shared/paypal-logo-129x32.svg /images/shared/paypal-logo-129x32.svg /images/shared/paypal-logo-129x32.svg /images/shared/paypal-logo-129x32.svg /images/shared/paypal-logo-129x32.svg /images/shared/paypal-logo-129x32.svg /images/shared/paypal-logo-129x32.svg /images/shared /images content-encoding gzip vary Accept-Encoding content-length 1929 x-served-by cache-lax8641-LAX, cache-sjc10056-SJC, cache-hhn4073-HHN last-modified Fri, 24 Oct 2014 22:52:57 GMT server Apache x-timer S1614365180.710214,VS0,VE0 strict-transport-security max-age=31557600 content-type image/svg+xml access-control-allow-origin * cache-control max-age=3600 accept-ranges bytes x-cache-hits 118840, 26632, 68096
GET H2	200	ts t.paypal.com/	42 B 682 B	225ms 173ms	Image image/gif	151.101.1.35 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://t.paypal.com/ts?v=1.4.30&t=1614365180098&g=-60&pgrp=main%3Aunifiedlogin%3A%3A%3Alogin&page=main%3Aunifiedlogin%3A%3A%3Alogin%3A%3A%3A&tmpl=unifiedloginnodeweb%2Fpublic%2Ftemplates%2Flogin.dust&pgst=1434716942421&lgin=%3A%3A&vers=unifiedlogin&calc=a096bf36597db&pgtf=Nodejs&s=ci&csci=2808349521df4e35a2199838d0ec94a8&goal=fwgt&fltp=unifiedlogin%3A%3A&e=im&imsrc=setup&view=%7B%22t10%22%3A420%2C%22t11%22%3A1305%2C%22tcp%22%3A1192%2C%22et%22%3A%224g%22%2C%22nt%22%3A%22navigate%22%2C%22bt%22%3A51%7D&cd=24&sw=1600&sh=1200&dw=1600&dh=1200&bw=1600&bh=1200&ce=1&t1=420&t1c=419&t1d=0&t1s=399&t2=489&t3=1&t4d=323&t4=343&t4e=20&tt=1254&rdc=0&res=%7B%7D Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.1.35 , United States, ASN54113 (FASTLY, US), Reverse DNS Software akka-http/10.1.11 / Resource Hash 6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93 Request headers Referer https://dev.klinikmatanusantara.com/log-au/mpp/signin/a961/websrc User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Fri, 26 Feb 2021 18:46:20 GMT via 1.1 varnish, 1.1 varnish server akka-http/10.1.11 x-timer S1614365180.159869,VS0,VE150 x-cache MISS, MISS p3p policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM" expires Fri, 26 Feb 2021 18:46:20 GMT cache-control no-cache, no-store, max-age=0, no-transform x-cache-hits 0, 0 accept-ranges bytes content-type image/gif content-length 42 x-served-by cache-lhr7336-LHR, cache-cdg20733-CDG

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

49 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| html5 object| Modernizr object| antiClickjack function| require function| requirejs function| define function| getGlobal object| dust function| extend function| $ function| jQuery function| _ object| Backbone string| sc_code_ver string| s_account object| s function| s_doPlugins string| s_code string| s_objectID function| s_gi function| s_giqf string| s_an function| s_sp function| s_jn function| s_rep function| s_d function| s_fe function| s_fa function| s_ft object| s_c_il number| s_c_in number| s_giq function| scOnload object| PAYPAL object| fpti string| fptiserverurl object| _ifpti string| j object| s_i_paypal object| jQuery180003711246817553682

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.klinikmatanusantara.com/	1969-12-31 23:59:59	Name: s_sess Value: %20s_ppv%3D100%3B%20s_cc%3Dtrue%3B%20v31%3Dmain%253Aunifiedlogin%253A%253A%253Alogin%3B%20s_sq%3D%3B
			.klinikmatanusantara.com/	1970-01-20 09:57:17	Name: s_pers Value: %20s_fid%3D0686A9A77D2FFDC1-0A4ACB97A4E2878B%7C1677437179804%3B%20gpv_c43%3Dmain%253Aunifiedlogin%253A%253A%253Alogin%7C1614366979806%3B%20tr_p1%3Dmain%253Aunifiedlogin%253A%253A%253Alogin%7C1614366979809%3B%20gpv_events%3Dno%2520value%7C1614366979812%3B

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dev.klinikmatanusantara.com
t.paypal.com
www.paypalobjects.com
117.54.5.10
151.101.1.35
151.101.114.133
0eb22afbab03bbbd8a47d4fc5361ff7518a77273e99fd0b73e235c93dd6ea7aa
18c9428f5ed837e027c6fcf29afe9d1f63a1e1e5b53ee1dc6373cf1cd1ea22aa
52a869c83e666b2e0bb71551c7bc6397e798b25942f780dd5151a6b7c08bc575
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
8ccea9cb8f9aa73d4f0c1666edb87685b74ffa482059caa0ae688646801a4392
a3195c32223d26b58679477a416061d223424f839d9a8f41dc82c4d9fee25a59
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
c007d73792ac2d25882bfbb573e700e721a0adacfab947e6a0b64a61991fecf0