istanaanekaban.com - urlscan.io

Summary

This website contacted 2 IPs in 4 countries across 4 domains to perform 5 HTTP transactions. The main IP is 202.67.10.171, located in Jakarta, Indonesia and belongs to DHECYBER-AS-ID PT. Dhecyber Flow Indonesia, ID. The main domain is istanaanekaban.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on January 29th 2022. Valid for: 3 months.

This is the only time istanaanekaban.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	35.241.186.140 35.241.186.140	15169 (GOOGLE) (GOOGLE)
1 1	160.16.237.149 160.16.237.149	9370 (SAKURA-B ...) (SAKURA-B SAKURA Internet Inc.)
3	202.67.10.171 202.67.10.171	24195 (DHECYBER-...) (DHECYBER-AS-ID PT. Dhecyber Flow Indonesia)
2	2a04:4e42::272 2a04:4e42::272	54113 (FASTLY) (FASTLY)
5	2

1 35.241.186.140 (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 140.186.241.35.bc.googleusercontent.com

x6wh6.mjt.lu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 160.16.237.149 (Tokyo, Japan) 1 redirects

ASN9370 (SAKURA-B SAKURA Internet Inc., JP)
PTR: delete.paps.jp

qr.paps.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 202.67.10.171 (Jakarta, Indonesia)

ASN24195 (DHECYBER-AS-ID PT. Dhecyber Flow Indonesia, ID)
PTR: jak106.gppnetwork.com

istanaanekaban.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42::272 (United States)

ASN54113 (FASTLY, US)

m.media-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	istanaanekaban.com istanaanekaban.com	33 KB
2	media-amazon.com m.media-amazon.com — Cisco Umbrella Rank: 613	44 KB
1	paps.jp 1 redirects qr.paps.jp	296 B
1	mjt.lu 1 redirects x6wh6.mjt.lu	155 B
5	4

	Domain	Requested by
3	istanaanekaban.com	istanaanekaban.com
2	m.media-amazon.com	istanaanekaban.com
1	qr.paps.jp	1 redirects
1	x6wh6.mjt.lu	1 redirects
5	4

This site contains links to these domains. Also see Links.

Domain
www.amazon.com

Subject Issuer	Validity	Valid
istanaanekaban.com cPanel, Inc. Certification Authority	`2022-01-29` - `2022-04-29`	3 months	crt.sh
images-na.ssl-images-amazon.com DigiCert Global CA G2	`2021-08-09` - `2022-07-24`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://istanaanekaban.com/ap/signin?session=f4c684705843da3b30d040efdca3f8476fc4cdcb
Frame ID: D0E0A137D62ECAADD463CEC9024C5C1E
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazon Anmelden

Page URL History Show full URLs

http://x6wh6.mjt.lu/lnk/AVQAAEzEU74AAAAAAAAAAC9puoEAAAAAhIkAAAAAABPIzABiEyK8TGA5CBXnSuO5uRaZgEQj... HTTP 302
https://qr.paps.jp/S25QZ HTTP 302
https://istanaanekaban.com/?appsecure Page URL
https://istanaanekaban.com/ap/signin?session=f4c684705843da3b30d040efdca3f8476fc4cdcb Page URL

Page Statistics

5
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

2
IPs

4
Countries

77 kB
Transfer

224 kB
Size

1
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.amazon.com/ap/forgotpassword?showRememberMe=true&openid.pape.max_auth_age=0&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=usflex&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dnav_ya_signin&prevRID=BRHA9NYG75BQK2E6TR1F&openid.assoc_handle=usflex&openid.mode=checkid_setup&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: Forgot your password?

Search URL Search Domain Scan URL

URL: https://www.amazon.com/ap/register?showRememberMe=true&openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dnav_ya_signin&prevRID=5E2S0M02YQK0KWXY6QRW&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=usflex&openid.mode=checkid_setup&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=usflex&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: Erstellen Sie Ihr Amazon-Konto

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://x6wh6.mjt.lu/lnk/AVQAAEzEU74AAAAAAAAAAC9puoEAAAAAhIkAAAAAABPIzABiEyK8TGA5CBXnSuO5uRaZgEQjhQATsEc/1/qQgIZoAkRqV_hDEcg1tiRw/aHR0cHM6Ly9xci5wYXBzLmpwL1MyNVFa HTTP 302
https://qr.paps.jp/S25QZ HTTP 302
https://istanaanekaban.com/?appsecure Page URL
https://istanaanekaban.com/ap/signin?session=f4c684705843da3b30d040efdca3f8476fc4cdcb Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://x6wh6.mjt.lu/lnk/AVQAAEzEU74AAAAAAAAAAC9puoEAAAAAhIkAAAAAABPIzABiEyK8TGA5CBXnSuO5uRaZgEQjhQATsEc/1/qQgIZoAkRqV_hDEcg1tiRw/aHR0cHM6Ly9xci5wYXBzLmpwL1MyNVFa HTTP 302
https://qr.paps.jp/S25QZ HTTP 302
https://istanaanekaban.com/?appsecure

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
istanaanekaban.com/
Redirect Chain

http://x6wh6.mjt.lu/lnk/AVQAAEzEU74AAAAAAAAAAC9puoEAAAAAhIkAAAAAABPIzABiEyK8TGA5CBXnSuO5uRaZgEQjhQATsEc/1/qQgIZoAkRqV_hDEcg1tiRw/aHR0cHM6Ly9xci5wYXBzLmpwL1MyNVFa
https://qr.paps.jp/S25QZ
https://istanaanekaban.com/?appsecure

121 B
434 B

3716ms
2379ms

Document
text/html

202.67.10.171
DHECYBER-AS-ID PT...

General

Check archive.org

Show headers Download Go to

Full URL: https://istanaanekaban.com/?appsecure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 202.67.10.171 Jakarta, Indonesia, ASN24195 (DHECYBER-AS-ID PT. Dhecyber Flow Indonesia, ID),
Reverse DNS: jak106.gppnetwork.com
Software: nginx / PHP/5.6.40
Resource Hash: ae89749cc91d8c069b4473d1f80a6f600cb7673fcc7fdab2f647f027e27171fe

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

server: nginx
date: Wed, 23 Feb 2022 07:12:12 GMT
content-type: text/html; charset=UTF-8
content-length: 123
x-powered-by: PHP/5.6.40
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
vary: Accept-Encoding,User-Agent
content-encoding: gzip

Redirect headers

Date: Wed, 23 Feb 2022 07:12:10 GMT
Server: Apache/2.4.37 (centos) OpenSSL/1.1.1g
X-Powered-By: PHP/7.4.19
location: https://istanaanekaban.com/?appsecure
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H2 200 Primary Request signin Show response
istanaanekaban.com/ap/ 7 KB
3 KB 1890ms
1889ms Document
text/html 202.67.10.171
DHECYBER-AS-ID PT...

General

Check archive.org

Show headers Download Go to

Full URL

https://istanaanekaban.com/ap/signin?session=f4c684705843da3b30d040efdca3f8476fc4cdcb

Requested by

Host: istanaanekaban.com
URL: https://istanaanekaban.com/?appsecure

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

202.67.10.171 Jakarta, Indonesia, ASN24195 (DHECYBER-AS-ID PT. Dhecyber Flow Indonesia, ID),

Reverse DNS

jak106.gppnetwork.com

Software

nginx / PHP/5.6.40

Resource Hash

ce2f9bfb08996f6ccf6d515e988d3e7037b2ae006c711a55bc6d6d7b29a07740

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://istanaanekaban.com/?appsecure

Response headers

server: nginx
date: Wed, 23 Feb 2022 07:12:14 GMT
content-type: text/html; charset=UTF-8
content-length: 2524
x-powered-by: PHP/5.6.40
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
vary: Accept-Encoding,User-Agent
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 main.css
istanaanekaban.com/assets/css/ 173 KB
30 KB 620ms
620ms Stylesheet
text/css 202.67.10.171
DHECYBER-AS-ID PT...

General

Check archive.org

Show headers Download Go to

Full URL: https://istanaanekaban.com/assets/css/main.css
Requested by: Host: istanaanekaban.com
URL: https://istanaanekaban.com/ap/signin?session=f4c684705843da3b30d040efdca3f8476fc4cdcb
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 202.67.10.171 Jakarta, Indonesia, ASN24195 (DHECYBER-AS-ID PT. Dhecyber Flow Indonesia, ID),
Reverse DNS: jak106.gppnetwork.com
Software: nginx /
Resource Hash: c53294daa2b521e9c969be5ad264b0c281463b9a9f0fbe341b802d6485a24d19

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://istanaanekaban.com/ap/signin?session=f4c684705843da3b30d040efdca3f8476fc4cdcb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 23 Feb 2022 07:12:14 GMT
content-encoding: gzip
last-modified: Fri, 22 Feb 2019 22:33:34 GMT
server: nginx
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=28800
accept-ranges: bytes
content-length: 30258

GET
H2 200 AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png
m.media-amazon.com/images/G/01/AUIClients/ 27 KB
28 KB 54ms
7ms Image
image/png 2a04:4e42::272
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png
Requested by: Host: istanaanekaban.com
URL: https://istanaanekaban.com/assets/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::272 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://istanaanekaban.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: https://www.amazon.com
date: Wed, 23 Feb 2022 07:12:17 GMT
last-modified: Fri, 22 Sep 2017 00:23:19 GMT
age: 2509336
x-cache: HIT from fastly, HIT from fastly
x-nginx-cache-status: HIT
access-control-allow-origin: *
expires: Sun, 19 Jan 2042 09:12:20 GMT
cache-control: max-age=630720000,public
x-amz-ir-id: c1f28bd2-ebc7-47cc-893b-3892643c7605
accept-ranges: bytes
content-type: image/png
content-length: 27972
x-served-by: cache-iad-kjyo7100093-IAD, cache-hhn4080-HHN

GET
H2 200 AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa._V2_.woff2
m.media-amazon.com/images/G/01/AUIClients/ 16 KB
17 KB 51ms
8ms Font
application/font-woff2 2a04:4e42::272
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa._V2_.woff2
Requested by: Host: istanaanekaban.com
URL: https://istanaanekaban.com/assets/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::272 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 013d1dc68fadda651c773b6deb153e3e8b4dd612fb2af70db48c87af7808d1e7

Request headers

Referer: https://istanaanekaban.com/
Origin: https://istanaanekaban.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: https://www.amazon.com
date: Wed, 23 Feb 2022 07:12:17 GMT
last-modified: Sat, 11 Jun 2016 01:31:21 GMT
age: 15672686
x-cache: HIT from fastly, HIT from fastly
x-nginx-cache-status: HIT
access-control-allow-origin: *
expires: Fri, 16 Aug 2041 22:02:26 GMT
cache-control: max-age=630720000,public
x-amz-ir-id: cd2dfa56-56e3-463f-a489-c7cdf8292a7f
accept-ranges: bytes
content-type: application/font-woff2; charset=utf-8
content-length: 16616
x-served-by: cache-dca17765-DCA, cache-hhn4080-HHN

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone number| ue_t0

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			istanaanekaban.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: eb1c67a804172259c8578438bce02a76

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

istanaanekaban.com
m.media-amazon.com
qr.paps.jp
x6wh6.mjt.lu
160.16.237.149
202.67.10.171
2a04:4e42::272
35.241.186.140
013d1dc68fadda651c773b6deb153e3e8b4dd612fb2af70db48c87af7808d1e7
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
ae89749cc91d8c069b4473d1f80a6f600cb7673fcc7fdab2f647f027e27171fe
c53294daa2b521e9c969be5ad264b0c281463b9a9f0fbe341b802d6485a24d19
ce2f9bfb08996f6ccf6d515e988d3e7037b2ae006c711a55bc6d6d7b29a07740

istanaanekaban.com Open in urlscan Pro 202.67.10.171 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

5 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

2 IPs

4 Countries

77 kBTransfer

224 kBSize

1 Cookies

2 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

istanaanekaban.com Open in urlscan Pro
202.67.10.171 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

2
IPs

4
Countries

77 kB
Transfer

224 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!