urlscan.io logo urlscan.io
SecurityTrails logo

ssl-log-service.tulisandin.my.id Open in urlscan Pro
103.160.37.195  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://tx.reb.gv.uk.8lw.barsamrokesh.ir/1/1/?wBmMxsLZUz6
Effective URL: https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Submission: On June 21 via manual from GB — Scanned from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 13 HTTP transactions. The main IP is 103.160.37.195, located in Indonesia and belongs to IDNIC-JETORBIT-AS-ID PT Jetorbit Teknologi Indonesia, ID. The main domain is ssl-log-service.tulisandin.my.id.
TLS certificate: Issued by R3 on May 27th 2024. Valid for: 3 months.
This is the only time ssl-log-service.tulisandin.my.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UK Government (Government)

Domain & IP information

IP Address AS Autonomous System
2 2 31.25.91.4 34412 (SABA-HOST)
1 103.28.36.123 131353 (NHANHOA-A...)
1 13 103.160.37.195 141584 (IDNIC-JET...)
13 3
Apex Domain
Subdomains		 Transfer
13 tulisandin.my.id
ssl-log-service.tulisandin.my.id
369 KB
2 barsamrokesh.ir
tx.reb.gv.uk.8lw.barsamrokesh.ir
725 B
1 shinlee.vn
tv.shinlee.vn
383 B
13 3
Domain Requested by
13 ssl-log-service.tulisandin.my.id 1 redirects tv.shinlee.vn
ssl-log-service.tulisandin.my.id
2 tx.reb.gv.uk.8lw.barsamrokesh.ir 2 redirects
1 tv.shinlee.vn
13 3

This site contains no links.

Subject Issuer Validity Valid
tv.shinlee.vn
R3		 2024-05-26 -
2024-08-24		 3 months crt.sh
www.ssl-log-service.tulisandin.my.id
R3		 2024-05-27 -
2024-08-25		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Frame ID: 0A8A578F42E63D791081A751BE0729C0
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Enter Your Name And Address

Page URL History Show full URLs

  1. http://tx.reb.gv.uk.8lw.barsamrokesh.ir/1/1/?wBmMxsLZUz6 HTTP 307
    https://tx.reb.gv.uk.8lw.barsamrokesh.ir/1/1/?wBmMxsLZUz6 HTTP 302
    https://tv.shinlee.vn/.www/?sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true HTTP 307
    http://tx.reb.gv.uk.8lw.barsamrokesh.ir/1/1/?wBmMxsLZUz6 HTTP 302
    https://tv.shinlee.vn/.www/?sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true Page URL
  2. https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/?sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true HTTP 302
    https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • <link[^>]+govuk-template[^>"]+css
  • <link[^>]+govuk-template-print[^>"]+css
  • <link[^>]+govuk-template-ie6[^>"]+css
  • <link[^>]+govuk-template-ie7[^>"]+css
  • <link[^>]+govuk-template-ie8[^>"]+css
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

533 kB
Transfer

1017 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://tx.reb.gv.uk.8lw.barsamrokesh.ir/1/1/?wBmMxsLZUz6 HTTP 307
    https://tx.reb.gv.uk.8lw.barsamrokesh.ir/1/1/?wBmMxsLZUz6 HTTP 302
    https://tv.shinlee.vn/.www/?sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true HTTP 307
    http://tx.reb.gv.uk.8lw.barsamrokesh.ir/1/1/?wBmMxsLZUz6 HTTP 302
    https://tv.shinlee.vn/.www/?sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true Page URL
  2. https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/?sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true HTTP 302
    https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://tx.reb.gv.uk.8lw.barsamrokesh.ir/1/1/?wBmMxsLZUz6 HTTP 307
  • https://tx.reb.gv.uk.8lw.barsamrokesh.ir/1/1/?wBmMxsLZUz6 HTTP 302
  • https://tv.shinlee.vn/.www/?sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true HTTP 307
  • http://tx.reb.gv.uk.8lw.barsamrokesh.ir/1/1/?wBmMxsLZUz6 HTTP 302
  • https://tv.shinlee.vn/.www/?sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
tv.shinlee.vn/.www/
Redirect Chain
  • http://tx.reb.gv.uk.8lw.barsamrokesh.ir/1/1/?wBmMxsLZUz6
  • https://tx.reb.gv.uk.8lw.barsamrokesh.ir/1/1/?wBmMxsLZUz6
  • https://tv.shinlee.vn/.www/?sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
  • http://tx.reb.gv.uk.8lw.barsamrokesh.ir/1/1/?wBmMxsLZUz6
  • https://tv.shinlee.vn/.www/?sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
176 B
383 B 		Document
General
Check archive.org
Download Go to
Full URL
https://tv.shinlee.vn/.www/?sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
103.28.36.123 , Viet Nam, ASN131353 (NHANHOA-AS-VN NhanHoa Software company, VN),
Reverse DNS
wordpress-hosting12.nhanhoa.com
Software
Apache /
Resource Hash

Request headers

Accept-Language
en-GB,en;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Fri, 21 Jun 2024 15:01:23 GMT
Keep-Alive
timeout=5, max=100
Server
Apache
Transfer-Encoding
chunked

Redirect headers

Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
cache-control
no-cache, no-store, must-revalidate, max-age=0
content-encoding
gzip
content-length
20
content-type
text/html; charset=UTF-8
date
Fri, 21 Jun 2024 15:01:22 GMT
location
https://tv.shinlee.vn/.www/?sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
server
LiteSpeed
vary
Accept-Encoding
Primary Request start.php
ssl-log-service.tulisandin.my.id/67/4/2/8/7/
Redirect Chain
  • https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/?sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
  • https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
9 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Requested by
Host: tv.shinlee.vn
URL: https://tv.shinlee.vn/.www/?sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
103.160.37.195 , Indonesia, ASN141584 (IDNIC-JETORBIT-AS-ID PT Jetorbit Teknologi Indonesia, ID),
Reverse DNS
comet.jetorbit.net
Software
LiteSpeed /
Resource Hash
8f049ab5dd6f226cb83a0fa46fdcf56d5db74af80b7639b86086a1294e60016b

Request headers

Accept-Language
en-GB,en;q=0.9;q=0.9
Referer
https://tv.shinlee.vn/.www/?sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 21 Jun 2024 15:01:31 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
LiteSpeed
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control
no-cache, no-store, must-revalidate, max-age=0
content-length
0
content-type
text/html; charset=UTF-8
date
Fri, 21 Jun 2024 15:01:29 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
pragma
no-cache
server
LiteSpeed
jquery.min.js
ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/ 		82 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/jquery.min.js
Requested by
Host: ssl-log-service.tulisandin.my.id
URL: https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
103.160.37.195 , Indonesia, ASN141584 (IDNIC-JETORBIT-AS-ID PT Jetorbit Teknologi Indonesia, ID),
Reverse DNS
comet.jetorbit.net
Software
LiteSpeed /
Resource Hash
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 21 Jun 2024 15:01:32 GMT
content-encoding
br
last-modified
Thu, 30 Jul 2020 07:47:01 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length
28763
expires
Fri, 28 Jun 2024 15:01:32 GMT
govuk-template.css
ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/ 		20 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/govuk-template.css
Requested by
Host: ssl-log-service.tulisandin.my.id
URL: https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
103.160.37.195 , Indonesia, ASN141584 (IDNIC-JETORBIT-AS-ID PT Jetorbit Teknologi Indonesia, ID),
Reverse DNS
comet.jetorbit.net
Software
LiteSpeed /
Resource Hash
13aa82ee00bd9d59269c252d580447fd09dfcc71fbf7e0fe929d598c509bf79e

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 21 Jun 2024 15:01:32 GMT
content-encoding
br
last-modified
Thu, 30 Jul 2020 07:47:01 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
4074
expires
Fri, 28 Jun 2024 15:01:32 GMT
fonts.css
ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/ 		267 KB
197 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/fonts.css
Requested by
Host: ssl-log-service.tulisandin.my.id
URL: https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
103.160.37.195 , Indonesia, ASN141584 (IDNIC-JETORBIT-AS-ID PT Jetorbit Teknologi Indonesia, ID),
Reverse DNS
comet.jetorbit.net
Software
LiteSpeed /
Resource Hash
6813a04aa7ebe09726eda5fdd9c4abf1c5f151335adf0ad90474a5fe316e87ed

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 21 Jun 2024 15:01:32 GMT
content-encoding
br
last-modified
Thu, 30 Jul 2020 07:47:01 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
201094
expires
Fri, 28 Jun 2024 15:01:32 GMT
application.min.css
ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/ 		178 KB
38 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/application.min.css
Requested by
Host: ssl-log-service.tulisandin.my.id
URL: https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
103.160.37.195 , Indonesia, ASN141584 (IDNIC-JETORBIT-AS-ID PT Jetorbit Teknologi Indonesia, ID),
Reverse DNS
comet.jetorbit.net
Software
LiteSpeed /
Resource Hash
ab3a0f463d776896fd738585a03a21c34f591f138df27815a0eda176fc42bad6

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 21 Jun 2024 15:01:32 GMT
content-encoding
br
last-modified
Thu, 30 Jul 2020 07:47:01 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
38570
expires
Fri, 28 Jun 2024 15:01:32 GMT
gov.uk_logotype_crown.png
ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/ 		780 B
800 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/gov.uk_logotype_crown.png
Requested by
Host: ssl-log-service.tulisandin.my.id
URL: https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
103.160.37.195 , Indonesia, ASN141584 (IDNIC-JETORBIT-AS-ID PT Jetorbit Teknologi Indonesia, ID),
Reverse DNS
comet.jetorbit.net
Software
LiteSpeed /
Resource Hash
14b98db97bbd6cb1f33935d3e0d973fa68ca0c38fb5762b033423ceffe9e16f6

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 21 Jun 2024 15:01:32 GMT
last-modified
Thu, 30 Jul 2020 07:47:01 GMT
server
LiteSpeed
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
780
expires
Fri, 28 Jun 2024 15:01:32 GMT
open-government-licence_2x.png
ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/ 		504 B
524 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/open-government-licence_2x.png
Requested by
Host: ssl-log-service.tulisandin.my.id
URL: https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
103.160.37.195 , Indonesia, ASN141584 (IDNIC-JETORBIT-AS-ID PT Jetorbit Teknologi Indonesia, ID),
Reverse DNS
comet.jetorbit.net
Software
LiteSpeed /
Resource Hash
2dcbca9026a39b5e4cc536b2f842bd173148b018c7ce369a5930558f4de0e23b

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 21 Jun 2024 15:01:32 GMT
last-modified
Thu, 30 Jul 2020 07:47:01 GMT
server
LiteSpeed
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
504
expires
Fri, 28 Jun 2024 15:01:32 GMT
application.min.js
ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/ 		288 KB
91 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/application.min.js
Requested by
Host: ssl-log-service.tulisandin.my.id
URL: https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
103.160.37.195 , Indonesia, ASN141584 (IDNIC-JETORBIT-AS-ID PT Jetorbit Teknologi Indonesia, ID),
Reverse DNS
comet.jetorbit.net
Software
LiteSpeed /
Resource Hash
b1ba9b0ff9669b7ffd38f4c96d42441573db020edcd45d46f4468d76f1ccf40f

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 21 Jun 2024 15:01:33 GMT
content-encoding
br
last-modified
Thu, 30 Jul 2020 07:47:01 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
93503
expires
Fri, 28 Jun 2024 15:01:33 GMT
govuk-template-print.css
ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/ 		1 KB
584 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/govuk-template-print.css
Requested by
Host: ssl-log-service.tulisandin.my.id
URL: https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
103.160.37.195 , Indonesia, ASN141584 (IDNIC-JETORBIT-AS-ID PT Jetorbit Teknologi Indonesia, ID),
Reverse DNS
comet.jetorbit.net
Software
LiteSpeed /
Resource Hash
5bb990686d6668df3f9d5208b10fa83d2f5d55820b442be13542a3dfbd3e361a

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 21 Jun 2024 15:01:33 GMT
content-encoding
br
last-modified
Thu, 30 Jul 2020 07:47:01 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
562
expires
Fri, 28 Jun 2024 15:01:33 GMT
hmrc_crest_18px.png
ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/hmrc_crest_18px.png
Requested by
Host: ssl-log-service.tulisandin.my.id
URL: https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/application.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
103.160.37.195 , Indonesia, ASN141584 (IDNIC-JETORBIT-AS-ID PT Jetorbit Teknologi Indonesia, ID),
Reverse DNS
comet.jetorbit.net
Software
LiteSpeed /
Resource Hash
c208f82493fb15f9261ba474cf6615ddc22e51984177095c4d12d2ad39647ca9

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/application.min.css
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 21 Jun 2024 15:01:33 GMT
last-modified
Thu, 30 Jul 2020 07:47:01 GMT
server
LiteSpeed
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
1637
expires
Fri, 28 Jun 2024 15:01:33 GMT
govuk-crest.png
ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/govuk-crest.png
Requested by
Host: ssl-log-service.tulisandin.my.id
URL: https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/govuk-template.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
103.160.37.195 , Indonesia, ASN141584 (IDNIC-JETORBIT-AS-ID PT Jetorbit Teknologi Indonesia, ID),
Reverse DNS
comet.jetorbit.net
Software
LiteSpeed /
Resource Hash
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/govuk-template.css
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 21 Jun 2024 15:01:33 GMT
last-modified
Thu, 30 Jul 2020 07:47:01 GMT
server
LiteSpeed
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
3584
expires
Fri, 28 Jun 2024 15:01:33 GMT
truncated
/ 		94 KB
94 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30

Request headers

Referer
Origin
https://ssl-log-service.tulisandin.my.id
Accept-Language
en-GB,en;q=0.9;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
application/font-woff
truncated
/ 		71 KB
71 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba

Request headers

Referer
Origin
https://ssl-log-service.tulisandin.my.id
Accept-Language
en-GB,en;q=0.9;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
application/font-woff
favicon.ico
ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/ 		318 B
264 B 		Other
General
Check archive.org
Download Go to
Full URL
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/step1_files/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
103.160.37.195 , Indonesia, ASN141584 (IDNIC-JETORBIT-AS-ID PT Jetorbit Teknologi Indonesia, ID),
Reverse DNS
comet.jetorbit.net
Software
LiteSpeed /
Resource Hash
8332332d0e75065404a4180f03f52c6a8552024a14f3a9809e08d47e270c784f

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ssl-log-service.tulisandin.my.id/67/4/2/8/7/start.php?&sessionid=bce7a369e5990b35c434bb2d3de5b5a5&securessl=true
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 21 Jun 2024 15:01:34 GMT
content-encoding
br
last-modified
Thu, 30 Jul 2020 07:47:01 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
image/x-icon
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
184
expires
Fri, 28 Jun 2024 15:01:34 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UK Government (Government)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage function| $ function| jQuery function| dob_check object| jQuery1123024562091037707168 object| GOVUK object| _gaq object| JSON3 function| Mdtpdf function| onYouTubeIframeAPIReady

2 Cookies

Domain/Path Name / Value
ssl-log-service.tulisandin.my.id/ Name: PHPSESSID
Value: def16f1696de2c97441c97b86a992b44
.tulisandin.my.id/ Name: mdtpdf
Value: eyJ2ZXJzaW9uIjoxLCJ1c2VyQWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTI2LjAuMC4wIFNhZmFyaS81MzcuMzYiLCJsYW5ndWFnZSI6ImVuLUdCIiwiY29sb3JEZXB0aCI6MjQsInJlc29sdXRpb24iOiIxMjAweDE2MDAiLCJ0aW1lem9uZSI6LTYwLCJjbGllbnRTaWRlVGltZXN0YW1wIjoxNzE4OTgyMDkzNzY0LCJzZXNzaW9uU3RvcmFnZSI6dHJ1ZSwibG9jYWxTdG9yYWdlIjp0cnVlLCJpbmRleGVkREIiOnRydWUsInBsYXRmb3JtIjoiV2luMzIiLCJkb05vdFRyYWNrIjpmYWxzZSwibnVtYmVyT2ZQbHVnaW5zIjo1LCJwbHVnaW5zIjpbIlBERiBWaWV3ZXIiLCJDaHJvbWUgUERGIFZpZXdlciIsIkNocm9taXVtIFBERiBWaWV3ZXIiLCJNaWNyb3NvZnQgRWRnZSBQREYgVmlld2VyIiwiV2ViS2l0IGJ1aWx0LWluIFBERiJdfQ==