truncated Open in urlscan Pro
  Malicious Activity! Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://mardygym.co.id/Admin/zero.htm Page URL
2. data://truncated Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	zero.htm Show response mardygym.co.id/Admin/	128 KB 128 KB	817ms 203ms	Document text/html	103.24.13.91 IDNIC-CBNCLOUD-AS...
General Check archive.org Show headers Download Go to Full URL http://mardygym.co.id/Admin/zero.htm Protocol HTTP/1.1 Server 103.24.13.91 , Indonesia, ASN132644 (IDNIC-CBNCLOUD-AS-ID PT. Cyberindo Mega Persada, ID), Reverse DNS server3.e-cbncloud.co.id Software Apache / Resource Hash 76fff0b070ddaae67c75dfe1a0794488c314eb0c42487cdfc2ffd5583f4917cf Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mardygym.co.id Accept-Language en-US,en;q=0.8 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Cache-Control no-cache Connection keep-alive Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Mon, 27 Mar 2017 00:32:01 GMT Last-Modified Sun, 19 Mar 2017 14:49:43 GMT Server Apache Content-Type text/html Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 131175
GET DATA	200 OK	Primary Request truncated Show response /	96 KB 0		Document text/html
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e96e30d294c7993df0a92eb831b2bb8c5eea90b9b49b224cc6dc4cd09cdd6556 Request headers Upgrade-Insecure-Requests 1 Referer http://mardygym.co.id/Admin/zero.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Access-Control-Allow-Origin * Content-Type text/html;charset=US-ASCII
GET H/1.1	404 Not Found	favicon.ico mardygym.co.id/	328 B 328 B	203ms 201ms	Other text/html	103.24.13.91 IDNIC-CBNCLOUD-AS...
General Check archive.org Show headers Download Go to Full URL http://mardygym.co.id/favicon.ico Requested by Host: text URL: data:text/html;truncated Protocol HTTP/1.1 Server 103.24.13.91 , Indonesia, ASN132644 (IDNIC-CBNCLOUD-AS-ID PT. Cyberindo Mega Persada, ID), Reverse DNS server3.e-cbncloud.co.id Software Apache / Resource Hash 6b62a3658ad247e8f30d3e9f35da5e00ffac1ea09785bd1f0a9830f659cf01da Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mardygym.co.id Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/*,*/*;q=0.8 Cache-Control no-cache Connection keep-alive User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Mon, 27 Mar 2017 00:32:02 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 328 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	AppCentipede_Microsoft.svg auth.gfx.ms/16.000.26210.00/AppCentipede/	7 KB 3 KB	25ms 7ms	Image image/svg+xml	104.111.237.158 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://auth.gfx.ms/16.000.26210.00/AppCentipede/AppCentipede_Microsoft.svg Requested by Host: text URL: data:text/html;truncated Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.237.158 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a104-111-237-158.deploy.static.akamaitechnologies.com Software Microsoft-IIS/8.5 / Resource Hash bde5e27f76f371121f1955806f1b662f323f3793b079455f5bfe83365a393625 Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host auth.gfx.ms Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/*,*/*;q=0.8 Cache-Control no-cache Connection keep-alive User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Mon, 27 Mar 2017 00:32:04 GMT Content-Encoding gzip Last-Modified Thu, 29 Oct 2015 18:49:31 GMT PPServer PPV: 30 H: BAYIDSPRTS3G003 V: 0 ETag "802fba8b7a12d11:0" Vary Accept-Encoding Content-Type image/svg+xml Access-Control-Allow-Origin * Cache-Control max-age=587929 Connection keep-alive Accept-Ranges bytes Content-Length 2946 Server Microsoft-IIS/8.5
GET H/1.1	200 OK	Microsoft_Logotype_Gray.svg auth.gfx.ms/16.000.26210.00/	5 KB 2 KB	9ms 9ms	Image image/svg+xml	104.111.237.158 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://auth.gfx.ms/16.000.26210.00/Microsoft_Logotype_Gray.svg Requested by Host: text URL: data:text/html;truncated Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.237.158 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a104-111-237-158.deploy.static.akamaitechnologies.com Software Microsoft-IIS/8.5 / Resource Hash 356f7d1241f92c9de9c9cfd0bebb6c10d1b38508a3f37cebc26329c656bad19f Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host auth.gfx.ms Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/*,*/*;q=0.8 Cache-Control no-cache Connection keep-alive User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Mon, 27 Mar 2017 00:32:04 GMT Content-Encoding gzip Last-Modified Wed, 16 Sep 2015 20:18:51 GMT PPServer PPV: 30 H: BAYIDSPRTS3G001 V: 0 ETag "807c6e6bcf0d01:0" Vary Accept-Encoding Content-Type image/svg+xml Access-Control-Allow-Origin * Cache-Control max-age=589019 Connection keep-alive Accept-Ranges bytes Content-Length 2160 Server Microsoft-IIS/8.5
GET		web-search-content.png cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/	0 0
GET		video-search-content.png cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/	0 0
GET		google-images-content.png cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/	0 0
GET		google-translate-content.png cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/	0 0
GET		wikipedia-content.png cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/	0 0
GET		btn_settings.png cipmepknanmbbaneimacddfemfbfgpgo/images/content/	0 0
GET		facebook-share-content.png cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/	0 0
GET		twitter-content.png cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/	0 0
GET		pinterest-content.png cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/	0 0
GET		google-plus-center-content.png cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/	0 0
GET		linkedin-content.png cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/	0 0
GET		dropToShareHint.png cipmepknanmbbaneimacddfemfbfgpgo/images/content/	0 0
GET		dropToSearchHint.png cipmepknanmbbaneimacddfemfbfgpgo/images/content/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

cipmepknanmbbaneimacddfemfbfgpgo

URL

chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/web-search-content.png

Domain

cipmepknanmbbaneimacddfemfbfgpgo

URL

chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/video-search-content.png

Domain

cipmepknanmbbaneimacddfemfbfgpgo

URL

chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/google-images-content.png

Domain

cipmepknanmbbaneimacddfemfbfgpgo

URL

chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/google-translate-content.png

Domain

cipmepknanmbbaneimacddfemfbfgpgo

URL

chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/wikipedia-content.png

Domain

cipmepknanmbbaneimacddfemfbfgpgo

URL

chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/btn_settings.png

Domain

cipmepknanmbbaneimacddfemfbfgpgo

URL

chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/facebook-share-content.png

Domain

cipmepknanmbbaneimacddfemfbfgpgo

URL

chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/twitter-content.png

Domain

cipmepknanmbbaneimacddfemfbfgpgo

URL

chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/pinterest-content.png

Domain

cipmepknanmbbaneimacddfemfbfgpgo

URL

chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/google-plus-center-content.png

Domain

cipmepknanmbbaneimacddfemfbfgpgo

URL

chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/linkedin-content.png

Domain

cipmepknanmbbaneimacddfemfbfgpgo

URL

chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/dropToShareHint.png

Domain

cipmepknanmbbaneimacddfemfbfgpgo

URL

chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/dropToSearchHint.png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth.gfx.ms
cipmepknanmbbaneimacddfemfbfgpgo
mardygym.co.id
cipmepknanmbbaneimacddfemfbfgpgo
103.24.13.91
104.111.237.158
356f7d1241f92c9de9c9cfd0bebb6c10d1b38508a3f37cebc26329c656bad19f
6b62a3658ad247e8f30d3e9f35da5e00ffac1ea09785bd1f0a9830f659cf01da
76fff0b070ddaae67c75dfe1a0794488c314eb0c42487cdfc2ffd5583f4917cf
bde5e27f76f371121f1955806f1b662f323f3793b079455f5bfe83365a393625
e96e30d294c7993df0a92eb831b2bb8c5eea90b9b49b224cc6dc4cd09cdd6556