simpeg.kalbarprov.go.id Open in urlscan Pro
103.134.19.92  Malicious Activity! Public Scan

URL: https://simpeg.kalbarprov.go.id/simpeg2020/aolm/aolre/reconfirm.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f...
Submission: On May 29 via automatic, source openphish — Scanned from DE

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 9 HTTP transactions. The main IP is 103.134.19.92, located in Indonesia and belongs to IDNIC-BROTHER-AS-ID PT. Waluya Istana Nusantara, ID. The main domain is simpeg.kalbarprov.go.id.
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 15th 2022. Valid for: 3 months.
This is the only time simpeg.kalbarprov.go.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) AOL (Online)

Domain & IP information

IP Address AS Autonomous System
1 103.134.19.92 138141 (IDNIC-BRO...)
8 2a00:1288:80:... 203220 (YAHOO-DEB)
9 2
Apex Domain
Subdomains
Transfer
7 yimg.com
s.yimg.com — Cisco Umbrella Rank: 378
195 KB
1 yahoo.com
fc.yahoo.com — Cisco Umbrella Rank: 1347
5 KB
1 kalbarprov.go.id
simpeg.kalbarprov.go.id
10 KB
9 3
Domain Requested by
7 s.yimg.com simpeg.kalbarprov.go.id
fc.yahoo.com
s.yimg.com
1 fc.yahoo.com s.yimg.com
1 simpeg.kalbarprov.go.id
9 3

This site contains links to these domains. Also see Links.

Domain
help.yahoo.com
www.aol.com
help.aol.com
login.aol.com
Subject Issuer Validity Valid
simpeg.kalbarprov.go.id
cPanel, Inc. Certification Authority
2022-05-15 -
2022-08-13
3 months crt.sh
*.fantasysports.yahoo.com
DigiCert SHA2 High Assurance Server CA
2022-05-02 -
2022-06-22
2 months crt.sh

This page contains 2 frames:

Primary Page: https://simpeg.kalbarprov.go.id/simpeg2020/aolm/aolre/reconfirm.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Frame ID: 241B10FDA3A8587FDECD5AE67D006F38
Requests: 8 HTTP requests in this frame

Frame: https://s.yimg.com/rq/darla/4-10-1/html/r-csc.html
Frame ID: F5F94A4CE92957DE7E8D0F1F77192DB0
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

AOL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • <link[^>]+(?:([\d.])+/)?pure(?:-min)?\.css
  • <div[^>]+class="[^"]*pure-u-(?:sm-|md-|lg-|xl-)?\d-\d

Page Statistics

9
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

211 kB
Transfer

612 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request reconfirm.php
simpeg.kalbarprov.go.id/simpeg2020/aolm/aolre/
10 KB
10 KB
Document
General
Full URL
https://simpeg.kalbarprov.go.id/simpeg2020/aolm/aolre/reconfirm.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
103.134.19.92 , Indonesia, ASN138141 (IDNIC-BROTHER-AS-ID PT. Waluya Istana Nusantara, ID),
Reverse DNS
Software
Apache /
Resource Hash
2b26c350a0d0870537458063903c076a2a5ddc8de3bf670c363153f0d430ad57

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Sun, 29 May 2022 01:32:42 GMT
Keep-Alive
timeout=5, max=100
Server
Apache
Transfer-Encoding
chunked
combo
s.yimg.com/zz/
28 KB
6 KB
Stylesheet
General
Full URL
https://s.yimg.com/zz/combo?yui-s:pure/0.5.0/pure-min.css&yui-s:pure/0.5.0/grids-responsive-min.css
Requested by
Host: simpeg.kalbarprov.go.id
URL: https://simpeg.kalbarprov.go.id/simpeg2020/aolm/aolre/reconfirm.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
56509fcb8d84185984927217765bf1afab5b5e217a3c06377bf1388377bb0d1b
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://simpeg.kalbarprov.go.id/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 05 May 2022 18:30:10 GMT
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 05 May 2022 18:30:10 GMT
server
ATS
age
2012555
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
x-xss-protection
1; mode=block
cache-control
max-age=31536000, Public
strict-transport-security
max-age=15552000
content-length
5607
x-content-type-options
nosniff
expires
Sat, 05 Sep 2026 00:00:00 GMT
aol-main.css
s.yimg.com/wm/mbr/2f308471ab1a6da2448769b5cdba9a5fec09b8da/
209 KB
47 KB
Stylesheet
General
Full URL
https://s.yimg.com/wm/mbr/2f308471ab1a6da2448769b5cdba9a5fec09b8da/aol-main.css
Requested by
Host: simpeg.kalbarprov.go.id
URL: https://simpeg.kalbarprov.go.id/simpeg2020/aolm/aolre/reconfirm.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
ede45bcb9c471636bb30c78141af29bbd617ff762b8791cec1a8d31361f3bd66
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://simpeg.kalbarprov.go.id/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Mon, 16 May 2022 02:03:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1121343
x-amz-server-side-encryption
AES256
vary
Origin, Accept-Encoding
x-amz-request-id
KF45J9FNNARZBN7N
x-amz-id-2
UA0wgpquk7IZig/+DpypbEAiIgQ4roaA0McpdM/TuQG/MpykW3UXoR2TDEGrPCoosUMe5SzG40k=
referrer-policy
no-referrer-when-downgrade
last-modified
Mon, 27 Aug 2018 17:09:15 GMT
server
ATS
etag
"9f5f453c052f3b9f9b27eabc53d289fe-df"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
content-type
text/css
x-xss-protection
1; mode=block
cache-control
public,max-age=315360000
accept-ranges
bytes
aol-logo-black-v.0.0.2.png
s.yimg.com/wm/assets/images/ns/
16 KB
16 KB
Image
General
Full URL
https://s.yimg.com/wm/assets/images/ns/aol-logo-black-v.0.0.2.png
Requested by
Host: simpeg.kalbarprov.go.id
URL: https://simpeg.kalbarprov.go.id/simpeg2020/aolm/aolre/reconfirm.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
f3e22262b472ee52e51e9f053856daf9a3f7ce59dd66d51f201f1ee7faaf5690
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://simpeg.kalbarprov.go.id/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Sat, 28 May 2022 17:53:47 GMT
x-amz-meta-created-date
Thu, 16 Nov 2017 19:59:27 GMT
age
27538
x-amz-server-side-encryption
AES256
x-amz-meta-x-ysws-mbst-vtime
1510862367682930
vary
Origin
x-amz-request-id
6S9CNCEXNZ8R7QWX
x-amz-id-2
zOIIAjWdtbtFqUhTMtxr5QQY+SpV8sQBNgCAieFmrsE+SnqRObNgDljVEOBUJhlgBwAgzd8S42k=
accept-ranges
bytes
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 04 May 2018 01:23:57 GMT
server
ATS
etag
"f9e0f24b60732cd95150a37fb003b871"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
content-type
image/png
x-xss-protection
1; mode=block
cache-control
max-age=31536000; public
content-length
16340
x-amz-meta-x-ysws-access
public
x-amz-meta-mbst-etag
"YM:1:3570f846-88d6-4c90-bd91-179d937c363c00055e1f0ebaf172"
x-content-type-options
nosniff
expires
Sat, 04 May 2019 01:23:56 GMT
bundle.js
s.yimg.com/wm/mbr/2f308471ab1a6da2448769b5cdba9a5fec09b8da/
125 KB
34 KB
Script
General
Full URL
https://s.yimg.com/wm/mbr/2f308471ab1a6da2448769b5cdba9a5fec09b8da/bundle.js
Requested by
Host: simpeg.kalbarprov.go.id
URL: https://simpeg.kalbarprov.go.id/simpeg2020/aolm/aolre/reconfirm.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
f1e1b9390d4497fbd0f027e3d3562d2a8fbe4a7acd829c904a6cbeea07883eee
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://simpeg.kalbarprov.go.id/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Sun, 15 May 2022 11:14:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1174702
x-amz-server-side-encryption
AES256
vary
Origin, Accept-Encoding
x-amz-request-id
JKHHC3T9WMDKT9KX
x-amz-id-2
8Log51HsQ/tP4p5bOFaz74K+HO88WOYhfC4UKRlcgco7xoPlmHqVUWQXhZCvRV/jhqw+8BH7Cpk=
referrer-policy
no-referrer-when-downgrade
last-modified
Mon, 27 Aug 2018 17:09:14 GMT
server
ATS
etag
"11305ce4ad122ee44d98fad6158137da-df"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
public,max-age=315360000
accept-ranges
bytes
client.php
fc.yahoo.com/sdarla/php/
10 KB
5 KB
Script
General
Full URL
https://fc.yahoo.com/sdarla/php/client.php?l=RICH{dest:tgtRICH;asz:flex}&f=150003036&ref=https%3A%2F%2Flogin.aol.com%2Faccount%2Fchallenge%2Fpassword
Requested by
Host: s.yimg.com
URL: https://s.yimg.com/wm/mbr/2f308471ab1a6da2448769b5cdba9a5fec09b8da/bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
af7e1754609246108e87646688db087171e2453f525637899ad87dd72996b743
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://simpeg.kalbarprov.go.id/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Sun, 29 May 2022 01:32:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
0
x-dns-prefetch-control
off
p3p
policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
vary
Accept-Encoding
content-length
4693
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
server
ATS
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
content-type
text/javascript;charset=UTF-8
cache-control
private,no-cache,no-store
x-robots-tag
noindex, noarchive, nosnippet, nofollow
boot.js
s.yimg.com/rq/darla/
7 KB
4 KB
Script
General
Full URL
https://s.yimg.com/rq/darla/boot.js
Requested by
Host: fc.yahoo.com
URL: https://fc.yahoo.com/sdarla/php/client.php?l=RICH{dest:tgtRICH;asz:flex}&f=150003036&ref=https%3A%2F%2Flogin.aol.com%2Faccount%2Fchallenge%2Fpassword
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
4530d183f6b42ae95bc7b2dafab9f38d1901b5c0e7f58253e35ec8e4215bacea
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://simpeg.kalbarprov.go.id/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Sat, 28 May 2022 19:47:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
20728
x-amz-server-side-encryption
AES256
vary
Origin, Accept-Encoding
x-amz-request-id
DN9ST4P5DP66P32V
x-amz-id-2
qMiBNo3/R2hiQrurbB0SlekYKPmT6kyyC4FVdyIjqcE3idKCLYoCPUZZ/jkzzPyz7PAQirVG5Xw=
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 24 Mar 2022 18:57:52 GMT
server
ATS
etag
"93d8df54e24138f615918242db0c49a3-df"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
content-type
application/javascript; charset=utf-8
x-xss-protection
1; mode=block
cache-control
public,max-age=86400
accept-ranges
bytes
g-r-min.js
s.yimg.com/rq/darla/4-10-1/js/
204 KB
86 KB
Script
General
Full URL
https://s.yimg.com/rq/darla/4-10-1/js/g-r-min.js
Requested by
Host: s.yimg.com
URL: https://s.yimg.com/rq/darla/boot.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
8c6a14a96e308f070f495f999af4e39027527d649157fe1a3ffc116870e14697
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://simpeg.kalbarprov.go.id/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

ats-carp-promotion
1
date
Tue, 26 Apr 2022 06:49:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2832182
x-amz-server-side-encryption
AES256
vary
Origin, Accept-Encoding
content-length
88197
x-amz-id-2
dgs62z9Y37MfWf7b33ccbLGSGqR6C8Bjeu5q5ILCmyN5abqRisFqjO/DoLKVwQ3TXpft7Kt7JwM=
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 24 Mar 2022 18:57:55 GMT
server
ATS
etag
"f6757e8569fef5f162212b684d6483ea-df"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
x-amz-request-id
6547HGB44C55DG0E
x-xss-protection
1; mode=block
cache-control
public,max-age=31536000
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
r-csc.html
s.yimg.com/rq/darla/4-10-1/html/ Frame F5F9
2 KB
1 KB
Document
General
Full URL
https://s.yimg.com/rq/darla/4-10-1/html/r-csc.html
Requested by
Host: s.yimg.com
URL: https://s.yimg.com/rq/darla/4-10-1/js/g-r-min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
3f1fdef4f502d2db072df997a1b83e977c3e257521551a9e4de98b1c28fa8a39
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://simpeg.kalbarprov.go.id/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
5022
cache-control
public,max-age=31536000
content-encoding
gzip
content-length
1160
content-type
text/html; charset=utf-8
date
Sun, 29 May 2022 00:09:03 GMT
etag
"1ff9b6e511ccd76562520a75bae161d2-df"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
last-modified
Thu, 24 Mar 2022 18:57:53 GMT
referrer-policy
no-referrer-when-downgrade
server
ATS
strict-transport-security
max-age=15552000
vary
Origin, Accept-Encoding
x-amz-id-2
b+NTcWt5K2qY6Pxdb2XdaKC8iLa2S1tDK9B8Jh5Q/1wgzaZ4zDwg6y91IWPC7DQEL7qG/3qwzR8=
x-amz-request-id
6WCHBJSY6ZPHF3JH
x-amz-server-side-encryption
AES256
x-content-type-options
nosniff
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) AOL (Online)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation object| oldError boolean| isGoodJS object| YUI_config object| I13N_config string| COMET_URL object| darlaConfig object| challenge function| mbrSendError object| jsModules boolean| mbrJSLoaded function| checkAssets object| DARLA_CONFIG object| DARLA object| $sf undefined| $yac boolean| sf_auto_0-29-4-2022 object| _Y

0 Cookies