upt-dinkes.gresikkab.go.id Open in urlscan Pro
103.170.104.118 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.dss.ill.xdl.veh.tax.uk.carrqepaxqft.smartqr.my/.xzx/.zqz/?cARrqepAXQft
Effective URL:
https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securess...
Submission: On March 26 via manual (March 26th 2023, 8:17:28 pm UTC) from GB — Scanned from GB

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 13 HTTP transactions. The main IP is 103.170.104.118, located in Indonesia and belongs to IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID. The main domain is upt-dinkes.gresikkab.go.id.
TLS certificate: Issued by AlphaSSL CA - SHA256 - G4 on December 8th 2022. Valid for: a year.

This is the only time upt-dinkes.gresikkab.go.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UK Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
1 1	101.99.69.81 101.99.69.81	45839 (SHINJIRU-...) (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd)
1 14	103.170.104.118 103.170.104.118	132634 (IDNIC-EGO...) (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO)
13	2

1 101.99.69.81 (Malaysia) 1 redirects

ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY)
PTR: server1.kamon.la

www.dss.ill.xdl.veh.tax.uk.carrqepaxqft.smartqr.my	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 103.170.104.118 (Indonesia) 1 redirects

ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID)

upt-dinkes.gresikkab.go.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	gresikkab.go.id 1 redirects upt-dinkes.gresikkab.go.id	600 KB
1	smartqr.my 1 redirects www.dss.ill.xdl.veh.tax.uk.carrqepaxqft.smartqr.my	419 B
13	2

	Domain	Requested by
14	upt-dinkes.gresikkab.go.id	1 redirects upt-dinkes.gresikkab.go.id
1	www.dss.ill.xdl.veh.tax.uk.carrqepaxqft.smartqr.my	1 redirects
13	2

This site contains no links.

Subject Issuer	Validity	Valid
*.gresikkab.go.id AlphaSSL CA - SHA256 - G4	`2022-12-08` - `2024-01-09`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true
Frame ID: 738CB3F2E3A303BDED4E2109AE686BF6
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Check if a vehicle is taxed and has an MOT

Page URL History Show full URLs

http://www.dss.ill.xdl.veh.tax.uk.carrqepaxqft.smartqr.my/.xzx/.zqz/?cARrqepAXQft HTTP 302
https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/?sessionid=95f4a73d18e6e6512509971707127918&... HTTP 302
https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

GOV.UK Template (UI frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+govuk-template[^>"]+css
<link[^>]+govuk-template-print[^>"]+css
<link[^>]+govuk-template-ie6[^>"]+css
<link[^>]+govuk-template-ie7[^>"]+css
<link[^>]+govuk-template-ie8[^>"]+css

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

764 kB
Transfer

761 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.dss.ill.xdl.veh.tax.uk.carrqepaxqft.smartqr.my/.xzx/.zqz/?cARrqepAXQft HTTP 302
https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/?sessionid=95f4a73d18e6e6512509971707127918&securessl=true HTTP 302
https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	404 Not Found	Primary Request vehicle.php Show response upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/ Redirect Chain http://www.dss.ill.xdl.veh.tax.uk.carrqepaxqft.smartqr.my/.xzx/.zqz/?cARrqepAXQft https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/?sessionid=95f4a73d18e6e6512509971707127918&securessl=true https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true	8 KB 8 KB	834ms 834ms	Document text/html	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `7d287a9eec11c31fc23f220251227c0c5041eaf42bcad555008c3ac29bde352c` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers Connection Keep-Alive Content-Type text/html;charset=utf-8 Date Sun, 26 Mar 2023 20:17:14 GMT Keep-Alive timeout=5, max=99 Server Apache Transfer-Encoding chunked Redirect headers Connection Keep-Alive Content-Length 0 Content-Type text/html;charset=utf-8 Date Sun, 26 Mar 2023 20:17:12 GMT Keep-Alive timeout=5, max=100 Location vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true Server Apache
GET H/1.1	200 OK	govuk-template.css upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	21 KB 21 KB	926ms 926ms	Stylesheet text/css	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/govuk-template.css Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `474355689b2be8afaf8855ef7bed7d420a624fdc662622acc13486a3a10eb86f` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Sun, 26 Mar 2023 20:17:15 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 21085
GET H/1.1	200 OK	govuk-elements-styles.css upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	44 KB 44 KB	964ms 962ms	Stylesheet text/css	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/govuk-elements-styles.css Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `faeb217e3bd29a944537a1c20d2f2c0460a67d003481bdd6667522f33d999731` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Sun, 26 Mar 2023 20:17:15 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 44595
GET H/1.1	200 OK	fonts.css upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	267 KB 267 KB	1684ms 963ms	Stylesheet text/css	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/fonts.css Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `a528ccc945a82c9af4b09971cffe3c6ecb37d9b9dc446c8f53cadc81cb8cea43` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Sun, 26 Mar 2023 20:17:15 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 273330
GET H/1.1	200 OK	application.css upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	81 KB 81 KB	2006ms 1285ms	Stylesheet text/css	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/application.css Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `95e6217d2b45e1a3c24a333cc9c33c45b9d8c99942a3870f7490bf459bfc646d` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Sun, 26 Mar 2023 20:17:15 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 83106
GET H/1.1	200 OK	numberplate.css upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	47 KB 48 KB	2221ms 1493ms	Stylesheet text/css	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/numberplate.css Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `b43f9e92939bf468dd2dc0e9c7637c3b6b8f3b4c821c1c877dab6c7617a98be1` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Sun, 26 Mar 2023 20:17:16 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 48424
GET H/1.1	200 OK	jquery-1.11.3.min.js Show response upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	94 KB 94 KB	2080ms 962ms	Script application/javascript	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/jquery-1.11.3.min.js Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `20e11ce61890c08c0529911822233c9023ebc367df6c1050dec105e2b9628104` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Sun, 26 Mar 2023 20:17:16 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 95962
GET H/1.1	200 OK	jquery.validate.min.js Show response upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	23 KB 23 KB	2727ms 984ms	Script application/javascript	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/jquery.validate.min.js Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `c4ec8763c6f7c6b9efc4a180baadbc2a4eaf9317f2781c9a4705c8c56774993d` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Sun, 26 Mar 2023 20:17:16 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 23073
GET H/1.1	200 OK	jquery.validate.unobtrusive.min.js Show response upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	6 KB 6 KB	3596ms 868ms	Script application/javascript	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/jquery.validate.unobtrusive.min.js Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `eb297808949feda2a532a73e1f1095d8e35e2ee2d4941b73ae2977f5ae388d11` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Sun, 26 Mar 2023 20:17:17 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 6276
GET H/1.1	200 OK	gov.uk_logotype_crown.png upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	1 KB 2 KB	909ms 909ms	Image image/png	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Show image Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/gov.uk_logotype_crown.png Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `ea874a79e09423d63420aff44f016fd0b92dc6dec0cc2668d63b150c8669875e` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Sun, 26 Mar 2023 20:17:19 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1415
GET H/1.1	200 OK	govuk-template-print.css upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	2 KB 2 KB	2936ms 2935ms	Stylesheet text/css	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/govuk-template-print.css Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `efb298d2297d1e2eb2922e8b5bd964ba733c3e9657389204ed664be85fe3c40e` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Sun, 26 Mar 2023 20:17:22 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1690
GET H/1.1	200 OK	open-government-licence.png upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	761 B 1002 B	954ms 953ms	Image image/png	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Show image Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/open-government-licence.png Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/govuk-template.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `c1aedc8257961b938b4c7a21a2b0db3f2716dd9ef782cea73110dc69107c9042` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/govuk-template.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Sun, 26 Mar 2023 20:17:20 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 761
GET H/1.1	200 OK	govuk-crest.png upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	4 KB 4 KB	1418ms 1418ms	Image image/png	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Show image Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/govuk-crest.png Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/govuk-template.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/govuk-template.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Sun, 26 Mar 2023 20:17:20 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 3584
GET DATA	200 OK	truncated /	94 KB 94 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30` Request headers Referer Origin https://upt-dinkes.gresikkab.go.id accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	71 KB 71 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba` Request headers Referer Origin https://upt-dinkes.gresikkab.go.id accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Content-Type application/font-woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UK Government (Government)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=13d2c015b84cefe349365df79d6dba42&securessl=true Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

upt-dinkes.gresikkab.go.id
www.dss.ill.xdl.veh.tax.uk.carrqepaxqft.smartqr.my
101.99.69.81
103.170.104.118
01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba
048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30
20e11ce61890c08c0529911822233c9023ebc367df6c1050dec105e2b9628104
474355689b2be8afaf8855ef7bed7d420a624fdc662622acc13486a3a10eb86f
7d287a9eec11c31fc23f220251227c0c5041eaf42bcad555008c3ac29bde352c
95e6217d2b45e1a3c24a333cc9c33c45b9d8c99942a3870f7490bf459bfc646d
a528ccc945a82c9af4b09971cffe3c6ecb37d9b9dc446c8f53cadc81cb8cea43
b43f9e92939bf468dd2dc0e9c7637c3b6b8f3b4c821c1c877dab6c7617a98be1
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b
c1aedc8257961b938b4c7a21a2b0db3f2716dd9ef782cea73110dc69107c9042
c4ec8763c6f7c6b9efc4a180baadbc2a4eaf9317f2781c9a4705c8c56774993d
ea874a79e09423d63420aff44f016fd0b92dc6dec0cc2668d63b150c8669875e
eb297808949feda2a532a73e1f1095d8e35e2ee2d4941b73ae2977f5ae388d11
efb298d2297d1e2eb2922e8b5bd964ba733c3e9657389204ed664be85fe3c40e
faeb217e3bd29a944537a1c20d2f2c0460a67d003481bdd6667522f33d999731

upt-dinkes.gresikkab.go.id Open in urlscan Pro 103.170.104.118 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

764 kBTransfer

761 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

upt-dinkes.gresikkab.go.id Open in urlscan Pro
103.170.104.118 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

764 kB
Transfer

761 kB
Size

0
Cookies

13 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!