67523815387624789356926.web.id

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 5 HTTP transactions. The main IP is 103.55.39.44, located in Indonesia and belongs to IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID. The main domain is 67523815387624789356926.web.id.

This is the only time 67523815387624789356926.web.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1	103.55.39.44 103.55.39.44	136052 (IDNIC-IDC...) (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia)
2	2606:4700::68... 2606:4700::6810:5814	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:50c0:800... 2606:50c0:8003::153	54113 (FASTLY) (FASTLY)
1	51.210.32.132 51.210.32.132	16276 (OVH) (OVH)
5	4

1 103.55.39.44 (Indonesia)

ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID)
PTR: iix400.cloudhost.id

67523815387624789356926.web.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:5814 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:50c0:8003::153 (United States)

ASN54113 (FASTLY, US)

akmadce.github.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.210.32.132 (France)

ASN16276 (OVH, FR)
PTR: ns3172604.ip-51-210-32.eu

i.ibb.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 431	47 KB
1	ibb.co i.ibb.co — Cisco Umbrella Rank: 13587	26 KB
1	github.io akmadce.github.io	775 B
1	67523815387624789356926.web.id 67523815387624789356926.web.id	1 KB
5	4

	Domain	Requested by
2	cdn.jsdelivr.net	67523815387624789356926.web.id
1	i.ibb.co	67523815387624789356926.web.id
1	akmadce.github.io	67523815387624789356926.web.id
1	67523815387624789356926.web.id
5	4

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-03` - `2022-07-02`	a year	crt.sh
www.github.com DigiCert SHA2 High Assurance Server CA	`2020-05-06` - `2022-04-14`	2 years	crt.sh
ibb.co R3	`2022-02-05` - `2022-05-06`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://67523815387624789356926.web.id/
Frame ID: 167DA522394F52CB0D0A99C6E982269E
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Facebook Login

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

5
Requests

80 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

75 kB
Transfer

258 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
67523815387624789356926.web.id/ 3 KB
1 KB 1008ms
254ms Document
text/html 103.55.39.44
IDNIC-IDCLOUDHOST...

General

Check archive.org

Show headers Download Go to

Full URL: http://67523815387624789356926.web.id/
Protocol: HTTP/1.1
Server: 103.55.39.44 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),
Reverse DNS: iix400.cloudhost.id
Software: LiteSpeed /
Resource Hash: 24efd5b08bf263a50517ca94f80f9d3513d8af2164470b21b0534914d7d8d088

Request headers

Accept-Language: de-DE,de;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36

Response headers

Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-encoding: gzip
content-length: 1243
content-type: text/html; charset=UTF-8
date: Sat, 02 Apr 2022 22:52:05 GMT
server: LiteSpeed
vary: Accept-Encoding

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.0.1/dist/css/ 152 KB
24 KB 78ms
33ms Stylesheet
text/css 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.0.1/dist/css/bootstrap.min.css

Requested by

Host: 67523815387624789356926.web.id
URL: http://67523815387624789356926.web.id/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

847280dddfc7b6d0bc396dd2974f775bc0e866e7611c90e3fbe919628e8c2f30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://67523815387624789356926.web.id/
Origin: http://67523815387624789356926.web.id
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36

Response headers

date: Sat, 02 Apr 2022 22:52:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1085413
x-jsd-version: 5.0.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19126-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"25fef-PDndyutgvrSms9Gt5O+JOaWK1Zo"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 6f5d220a4c2f01fc-ZRH

GET
H2 200 radespandi.css
akmadce.github.io/fbpandi/ 808 B
775 B 630ms
346ms Stylesheet
text/css 2606:50c0:8003::153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://akmadce.github.io/fbpandi/radespandi.css

Requested by

Host: 67523815387624789356926.web.id
URL: http://67523815387624789356926.web.id/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8003::153 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

GitHub.com /

Resource Hash

7c3fb24975579798a17134a9b226f9df0add8d7cf7c0aaa728e60bde2bfaffa8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556952

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://67523815387624789356926.web.id/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36

Response headers

x-fastly-request-id: 70804fa884db64683e278499d094e4666a0af8d2
strict-transport-security: max-age=31556952
content-encoding: gzip
etag: W/"60f84061-328"
age: 0
x-cache: MISS
content-length: 354
x-served-by: cache-mxp6961-MXP
access-control-allow-origin: *
last-modified: Wed, 21 Jul 2021 15:42:25 GMT
server: GitHub.com
x-github-request-id: 748A:98A3:139BD7D:1418884:6248D396
x-timer: S1648939926.364950,VS0,VE107
date: Sat, 02 Apr 2022 22:52:06 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
via: 1.1 varnish
expires: Sat, 02 Apr 2022 23:02:06 GMT
cache-control: max-age=600
permissions-policy: interest-cohort=()
accept-ranges: bytes
x-proxy-cache: MISS
x-cache-hits: 0

GET
H2 200 logo.png
i.ibb.co/TwyKTPG/ 26 KB
26 KB 62ms
14ms Image
image/png 51.210.32.132
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/TwyKTPG/logo.png
Requested by: Host: 67523815387624789356926.web.id
URL: http://67523815387624789356926.web.id/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.210.32.132 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3172604.ip-51-210-32.eu
Software: nginx /
Resource Hash: 3796d8073e7a75b07ee9e30905b0a0af9c94aa70a610f284f2fe3e5dc3e701d8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://67523815387624789356926.web.id/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36

Response headers

date: Sat, 02 Apr 2022 22:52:06 GMT
last-modified: Mon, 01 Feb 2021 04:47:35 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 26177
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 bootstrap.bundle.min.js Show response
cdn.jsdelivr.net/npm/bootstrap@5.0.1/dist/js/ 77 KB
23 KB 65ms
21ms Script
application/javascript 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.0.1/dist/js/bootstrap.bundle.min.js

Requested by

Host: 67523815387624789356926.web.id
URL: http://67523815387624789356926.web.id/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

79d443b15f542c8a8acca8e937f2a3c90ecba78bd49fdbac6c9b878c7f1293e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://67523815387624789356926.web.id/
Origin: http://67523815387624789356926.web.id
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36

Response headers

date: Sat, 02 Apr 2022 22:52:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1085407
x-jsd-version: 5.0.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19149-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"1339c-XbTEDbxr09liPumKIGHdJliFzy4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 6f5d220a4c3001fc-ZRH

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

67523815387624789356926.web.id
akmadce.github.io
cdn.jsdelivr.net
i.ibb.co
103.55.39.44
2606:4700::6810:5814
2606:50c0:8003::153
51.210.32.132
24efd5b08bf263a50517ca94f80f9d3513d8af2164470b21b0534914d7d8d088
3796d8073e7a75b07ee9e30905b0a0af9c94aa70a610f284f2fe3e5dc3e701d8
79d443b15f542c8a8acca8e937f2a3c90ecba78bd49fdbac6c9b878c7f1293e9
7c3fb24975579798a17134a9b226f9df0add8d7cf7c0aaa728e60bde2bfaffa8
847280dddfc7b6d0bc396dd2974f775bc0e866e7611c90e3fbe919628e8c2f30

67523815387624789356926.web.id Open in urlscan Pro 103.55.39.44 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

5 Requests

80 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

75 kBTransfer

258 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Indicators

67523815387624789356926.web.id Open in urlscan Pro
103.55.39.44 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

80 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

75 kB
Transfer

258 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!