urlscan.io logo urlscan.io
SecurityTrails logo

tribratanews.respakpakbharat.sumut.polri.go.id Open in urlscan Pro
120.29.231.3  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://lg.gv.hm.rc.0o8z13.abkarizarif.ir/.qzq/.zqz/?wnmauvmM1H
Effective URL: https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Submission: On April 22 via manual from GB — Scanned from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 13 HTTP transactions. The main IP is 120.29.231.3, located in Indonesia and belongs to POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID. The main domain is tribratanews.respakpakbharat.sumut.polri.go.id.
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 22nd 2024. Valid for: 3 months.
This is the only time tribratanews.respakpakbharat.sumut.polri.go.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UK Government (Government)

Domain & IP information

IP Address AS Autonomous System
1 1 88.135.68.89 212296 (MIZBANFA)
1 42.112.30.39 18403 (FPT-AS-AP...)
1 13 120.29.231.3 38764 (POLRI-AS-...)
13 3
Apex Domain
Subdomains		 Transfer
13 polri.go.id
tribratanews.respakpakbharat.sumut.polri.go.id
368 KB
1 hclub.vn
hclub.vn
282 B
1 abkarizarif.ir
lg.gv.hm.rc.0o8z13.abkarizarif.ir
376 B
13 3
Domain Requested by
13 tribratanews.respakpakbharat.sumut.polri.go.id 1 redirects hclub.vn
tribratanews.respakpakbharat.sumut.polri.go.id
1 hclub.vn
1 lg.gv.hm.rc.0o8z13.abkarizarif.ir 1 redirects
13 3

This site contains no links.

Subject Issuer Validity Valid
www.hclub.vn
R3		 2024-04-08 -
2024-07-07		 3 months crt.sh
tribratanews.respakpakbharat.sumut.polri.go.id
cPanel, Inc. Certification Authority		 2024-03-22 -
2024-06-20		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Frame ID: 28B0E88B010BFA8CADDC84F4D70F7885
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Enter Your Name And Address

Page URL History Show full URLs

  1. http://lg.gv.hm.rc.0o8z13.abkarizarif.ir/.qzq/.zqz/?wnmauvmM1H HTTP 307
    https://lg.gv.hm.rc.0o8z13.abkarizarif.ir/.qzq/.zqz/?wnmauvmM1H HTTP 307
    http://lg.gv.hm.rc.0o8z13.abkarizarif.ir/.qzq/.zqz/?wnmauvmM1H HTTP 302
    https://hclub.vn/bin/?sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true Page URL
  2. https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/?sessionid=0008b6c4a9d91ab765d490dd45860b04&s... HTTP 302
    https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • <link[^>]+govuk-template[^>"]+css
  • <link[^>]+govuk-template-print[^>"]+css
  • <link[^>]+govuk-template-ie6[^>"]+css
  • <link[^>]+govuk-template-ie7[^>"]+css
  • <link[^>]+govuk-template-ie8[^>"]+css
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

533 kB
Transfer

1017 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://lg.gv.hm.rc.0o8z13.abkarizarif.ir/.qzq/.zqz/?wnmauvmM1H HTTP 307
    https://lg.gv.hm.rc.0o8z13.abkarizarif.ir/.qzq/.zqz/?wnmauvmM1H HTTP 307
    http://lg.gv.hm.rc.0o8z13.abkarizarif.ir/.qzq/.zqz/?wnmauvmM1H HTTP 302
    https://hclub.vn/bin/?sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true Page URL
  2. https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/?sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true HTTP 302
    https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://lg.gv.hm.rc.0o8z13.abkarizarif.ir/.qzq/.zqz/?wnmauvmM1H HTTP 307
  • https://lg.gv.hm.rc.0o8z13.abkarizarif.ir/.qzq/.zqz/?wnmauvmM1H HTTP 307
  • http://lg.gv.hm.rc.0o8z13.abkarizarif.ir/.qzq/.zqz/?wnmauvmM1H HTTP 302
  • https://hclub.vn/bin/?sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
hclub.vn/bin/
Redirect Chain
  • http://lg.gv.hm.rc.0o8z13.abkarizarif.ir/.qzq/.zqz/?wnmauvmM1H
  • https://lg.gv.hm.rc.0o8z13.abkarizarif.ir/.qzq/.zqz/?wnmauvmM1H
  • http://lg.gv.hm.rc.0o8z13.abkarizarif.ir/.qzq/.zqz/?wnmauvmM1H
  • https://hclub.vn/bin/?sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
210 B
282 B 		Document
General
Check archive.org
Download Go to
Full URL
https://hclub.vn/bin/?sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
42.112.30.39 Ho Chi Minh City, Viet Nam, ASN18403 (FPT-AS-AP FPT Telecom Company, VN),
Reverse DNS
3039.hostingviet.vn
Software
LiteSpeed / PHP/7.4.33
Resource Hash

Request headers

Accept-Language
en-GB,en;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

content-encoding
br
content-length
159
content-type
text/html; charset=UTF-8
date
Mon, 22 Apr 2024 13:54:35 GMT
server
LiteSpeed
vary
Accept-Encoding
x-powered-by
PHP/7.4.33

Redirect headers

Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
cache-control
no-cache, no-store, must-revalidate, max-age=0
content-encoding
gzip
content-length
20
content-type
text/html; charset=UTF-8
date
Mon, 22 Apr 2024 13:54:25 GMT
location
https://hclub.vn/bin/?sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
vary
Accept-Encoding
Primary Request start.php
tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/
Redirect Chain
  • https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/?sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
  • https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
9 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Requested by
Host: hclub.vn
URL: https://hclub.vn/bin/?sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID),
Reverse DNS
tribratanews.restaput.sumut.polri.go.id
Software
Apache /
Resource Hash
075e1a6244d0307400d9d16076b36fdbc918e2eb54b6e1a6d02db52c6706c5aa

Request headers

Accept-Language
en-GB,en;q=0.9;q=0.9
Referer
https://hclub.vn/bin/?sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
Keep-Alive
Content-Encoding
br
Content-Length
2691
Content-Type
text/html; charset=UTF-8
Date
Mon, 22 Apr 2024 13:54:42 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=99
Pragma
no-cache
Server
Apache
Vary
Accept-Encoding

Redirect headers

Connection
Keep-Alive
Content-Encoding
br
Content-Length
1
Content-Type
text/html; charset=UTF-8
Date
Mon, 22 Apr 2024 13:54:38 GMT
Keep-Alive
timeout=5, max=100
Location
start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Server
Apache
Vary
Accept-Encoding
jquery.min.js
tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/ 		82 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/jquery.min.js
Requested by
Host: tribratanews.respakpakbharat.sumut.polri.go.id
URL: https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID),
Reverse DNS
tribratanews.restaput.sumut.polri.go.id
Software
Apache /
Resource Hash
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Mon, 22 Apr 2024 13:54:45 GMT
Content-Encoding
br
Last-Modified
Thu, 30 Jul 2020 07:47:01 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
28801
govuk-template.css
tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/ 		20 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/govuk-template.css
Requested by
Host: tribratanews.respakpakbharat.sumut.polri.go.id
URL: https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID),
Reverse DNS
tribratanews.restaput.sumut.polri.go.id
Software
Apache /
Resource Hash
13aa82ee00bd9d59269c252d580447fd09dfcc71fbf7e0fe929d598c509bf79e

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Mon, 22 Apr 2024 13:54:46 GMT
Content-Encoding
br
Last-Modified
Thu, 30 Jul 2020 07:47:01 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
4086
fonts.css
tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/ 		267 KB
196 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/fonts.css
Requested by
Host: tribratanews.respakpakbharat.sumut.polri.go.id
URL: https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID),
Reverse DNS
tribratanews.restaput.sumut.polri.go.id
Software
Apache /
Resource Hash
6813a04aa7ebe09726eda5fdd9c4abf1c5f151335adf0ad90474a5fe316e87ed

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Mon, 22 Apr 2024 13:54:46 GMT
Content-Encoding
br
Last-Modified
Thu, 30 Jul 2020 07:47:01 GMT
Server
Apache
Vary
Accept-Encoding
Transfer-Encoding
chunked
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
application.min.css
tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/ 		178 KB
37 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/application.min.css
Requested by
Host: tribratanews.respakpakbharat.sumut.polri.go.id
URL: https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID),
Reverse DNS
tribratanews.restaput.sumut.polri.go.id
Software
Apache /
Resource Hash
ab3a0f463d776896fd738585a03a21c34f591f138df27815a0eda176fc42bad6

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Mon, 22 Apr 2024 13:54:46 GMT
Content-Encoding
br
Last-Modified
Thu, 30 Jul 2020 07:47:01 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
37787
gov.uk_logotype_crown.png
tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/ 		780 B
1022 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/gov.uk_logotype_crown.png
Requested by
Host: tribratanews.respakpakbharat.sumut.polri.go.id
URL: https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID),
Reverse DNS
tribratanews.restaput.sumut.polri.go.id
Software
Apache /
Resource Hash
14b98db97bbd6cb1f33935d3e0d973fa68ca0c38fb5762b033423ceffe9e16f6

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Mon, 22 Apr 2024 13:54:46 GMT
Last-Modified
Thu, 30 Jul 2020 07:47:01 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
780
open-government-licence_2x.png
tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/ 		504 B
746 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/open-government-licence_2x.png
Requested by
Host: tribratanews.respakpakbharat.sumut.polri.go.id
URL: https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID),
Reverse DNS
tribratanews.restaput.sumut.polri.go.id
Software
Apache /
Resource Hash
2dcbca9026a39b5e4cc536b2f842bd173148b018c7ce369a5930558f4de0e23b

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Mon, 22 Apr 2024 13:54:46 GMT
Last-Modified
Thu, 30 Jul 2020 07:47:01 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
504
application.min.js
tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/ 		288 KB
91 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/application.min.js
Requested by
Host: tribratanews.respakpakbharat.sumut.polri.go.id
URL: https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID),
Reverse DNS
tribratanews.restaput.sumut.polri.go.id
Software
Apache /
Resource Hash
b1ba9b0ff9669b7ffd38f4c96d42441573db020edcd45d46f4468d76f1ccf40f

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Mon, 22 Apr 2024 13:54:46 GMT
Content-Encoding
br
Last-Modified
Thu, 30 Jul 2020 07:47:01 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
92438
govuk-template-print.css
tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/ 		1 KB
848 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/govuk-template-print.css
Requested by
Host: tribratanews.respakpakbharat.sumut.polri.go.id
URL: https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID),
Reverse DNS
tribratanews.restaput.sumut.polri.go.id
Software
Apache /
Resource Hash
5bb990686d6668df3f9d5208b10fa83d2f5d55820b442be13542a3dfbd3e361a

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Mon, 22 Apr 2024 13:54:46 GMT
Content-Encoding
br
Last-Modified
Thu, 30 Jul 2020 07:47:01 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
563
hmrc_crest_18px.png
tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/hmrc_crest_18px.png
Requested by
Host: tribratanews.respakpakbharat.sumut.polri.go.id
URL: https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/application.min.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID),
Reverse DNS
tribratanews.restaput.sumut.polri.go.id
Software
Apache /
Resource Hash
c208f82493fb15f9261ba474cf6615ddc22e51984177095c4d12d2ad39647ca9

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/application.min.css
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Mon, 22 Apr 2024 13:54:47 GMT
Last-Modified
Thu, 30 Jul 2020 07:47:01 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
1637
govuk-crest.png
tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/govuk-crest.png
Requested by
Host: tribratanews.respakpakbharat.sumut.polri.go.id
URL: https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/govuk-template.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID),
Reverse DNS
tribratanews.restaput.sumut.polri.go.id
Software
Apache /
Resource Hash
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/govuk-template.css
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Mon, 22 Apr 2024 13:54:47 GMT
Last-Modified
Thu, 30 Jul 2020 07:47:01 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
3584
truncated
/ 		94 KB
94 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30

Request headers

Referer
Origin
https://tribratanews.respakpakbharat.sumut.polri.go.id
Accept-Language
en-GB,en;q=0.9;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
application/font-woff
truncated
/ 		71 KB
71 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba

Request headers

Referer
Origin
https://tribratanews.respakpakbharat.sumut.polri.go.id
Accept-Language
en-GB,en;q=0.9;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
application/font-woff
favicon.ico
tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/ 		318 B
477 B 		Other
General
Check archive.org
Download Go to
Full URL
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/step1_files/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID),
Reverse DNS
tribratanews.restaput.sumut.polri.go.id
Software
Apache /
Resource Hash
8332332d0e75065404a4180f03f52c6a8552024a14f3a9809e08d47e270c784f

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tribratanews.respakpakbharat.sumut.polri.go.id/.well-known/.zxz/7/24/26/19/20/start.php?&sessionid=0008b6c4a9d91ab765d490dd45860b04&securessl=true
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Mon, 22 Apr 2024 13:54:49 GMT
Content-Encoding
br
Last-Modified
Thu, 30 Jul 2020 07:47:01 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
image/x-icon
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=95
Content-Length
188

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UK Government (Government)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| dob_check object| jQuery112305378452501028455 object| GOVUK object| _gaq object| JSON3 function| Mdtpdf function| onYouTubeIframeAPIReady

2 Cookies

Domain/Path Name / Value
tribratanews.respakpakbharat.sumut.polri.go.id/ Name: PHPSESSID
Value: d7aubf418epg1hc1f1ijc18ue2
.respakpakbharat.sumut.polri.go.id/ Name: mdtpdf
Value: eyJ2ZXJzaW9uIjoxLCJ1c2VyQWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTI0LjAuMC4wIFNhZmFyaS81MzcuMzYiLCJsYW5ndWFnZSI6ImVuLUdCIiwiY29sb3JEZXB0aCI6MjQsInJlc29sdXRpb24iOiIxMjAweDE2MDAiLCJ0aW1lem9uZSI6LTYwLCJjbGllbnRTaWRlVGltZXN0YW1wIjoxNzEzNzk0MDg5MzQyLCJzZXNzaW9uU3RvcmFnZSI6dHJ1ZSwibG9jYWxTdG9yYWdlIjp0cnVlLCJpbmRleGVkREIiOnRydWUsInBsYXRmb3JtIjoiV2luMzIiLCJkb05vdFRyYWNrIjpmYWxzZSwibnVtYmVyT2ZQbHVnaW5zIjo1LCJwbHVnaW5zIjpbIlBERiBWaWV3ZXIiLCJDaHJvbWUgUERGIFZpZXdlciIsIkNocm9taXVtIFBERiBWaWV3ZXIiLCJNaWNyb3NvZnQgRWRnZSBQREYgVmlld2VyIiwiV2ViS2l0IGJ1aWx0LWluIFBERiJdfQ==