icta.ubhara.ac.id Open in urlscan Pro
203.166.217.40 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://icta.ubhara.ac.id/wp-content/uploads/2017/08/cms_menu/journal/typo3_src-4.php/mhwsy/yhmy/?corn=107dvq7tdy7q
Effective URL:
http://icta.ubhara.ac.id/wp-content/uploads/2017/08/cms_menu/journal/typo3_src-4.php/ags/rbqwx/?9xb9d9qd9dk0
Submission: On January 23 via manual (January 23rd 2020, 2:39:26 pm UTC) from GB

Summary HTTP 3 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 203.166.217.40, located in Indonesia and belongs to UBHARA-AS-ID Universitas Bhayangkara, ID. The main domain is icta.ubhara.ac.id.

This is the only time icta.ubhara.ac.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Lion's Den Scam (Online)

Domain & IP information

	IP Address		AS Autonomous System
2	203.166.217.40 203.166.217.40		45319 (UBHARA-AS...) (UBHARA-AS-ID Universitas Bhayangkara)
1	2606:4700::68... 2606:4700::6811:4104		13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	3

2 203.166.217.40 (Indonesia)

ASN45319 (UBHARA-AS-ID Universitas Bhayangkara, ID)

icta.ubhara.ac.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:4104 (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	ubhara.ac.id icta.ubhara.ac.id	3 KB
1	cloudflare.com cdnjs.cloudflare.com	30 KB
3	2

	Domain	Requested by
2	icta.ubhara.ac.id	icta.ubhara.ac.id
1	cdnjs.cloudflare.com	icta.ubhara.ac.id
3	2

This site contains no links.

Subject Issuer	Validity	Valid
cloudflare.com CloudFlare Inc ECC CA-2	`2020-01-07` - `2020-10-09`	9 months	crt.sh

This page contains 1 frames:

Primary Page: http://icta.ubhara.ac.id/wp-content/uploads/2017/08/cms_menu/journal/typo3_src-4.php/ags/rbqwx/?9xb9d9qd9dk0
Frame ID: A7C7F639492BC69FEF6FE36D5B520A98
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://icta.ubhara.ac.id/wp-content/uploads/2017/08/cms_menu/journal/typo3_src-4.php/mhwsy/yhmy/?corn... Page URL
http://icta.ubhara.ac.id/wp-content/uploads/2017/08/cms_menu/journal/typo3_src-4.php/ags/rbqwx/?9xb9d... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

mod_dav (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /\b(?:mod_)?DAV\b(?:\/([\d.]+))?/i

mod_ssl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_ssl(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
headers server /\b(?:mod_)?DAV\b(?:\/([\d.]+))?/i
headers server /mod_ssl(?:\/([\d.]+))?/i

Page Statistics

3
Requests

33 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

33 kB
Transfer

483 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://icta.ubhara.ac.id/wp-content/uploads/2017/08/cms_menu/journal/typo3_src-4.php/mhwsy/yhmy/?corn=107dvq7tdy7q Page URL
http://icta.ubhara.ac.id/wp-content/uploads/2017/08/cms_menu/journal/typo3_src-4.php/ags/rbqwx/?9xb9d9qd9dk0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

http://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js HTTP 307
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js

3 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
icta.ubhara.ac.id/wp-content/uploads/2017/08/cms_menu/journal/typo3_src-4.php/mhwsy/yhmy/ 3 KB
3 KB 2694ms
1955ms Document
text/html 203.166.217.40
UBHARA-AS-ID Univ...

General

Check archive.org

Show headers Download Go to

Full URL: http://icta.ubhara.ac.id/wp-content/uploads/2017/08/cms_menu/journal/typo3_src-4.php/mhwsy/yhmy/?corn=107dvq7tdy7q
Protocol: HTTP/1.1
Server: 203.166.217.40 , Indonesia, ASN45319 (UBHARA-AS-ID Universitas Bhayangkara, ID),
Reverse DNS
Software: Apache/2.2.27 (Unix) DAV/2 PHP/5.5.14 mod_ssl/2.2.27 LibreSSL/2.0 / PHP/5.5.14
Resource Hash: ca707e79a1f672c97ec17dd878cbda71d3d0a13dbb3be46feecd4f77e3b26a7a

Request headers

Host: icta.ubhara.ac.id
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Thu, 23 Jan 2020 14:58:07 GMT
Server: Apache/2.2.27 (Unix) DAV/2 PHP/5.5.14 mod_ssl/2.2.27 LibreSSL/2.0
X-Powered-By: PHP/5.5.14
Content-Length: 3024
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

GET
H/1.1 200
OK Primary Request /
icta.ubhara.ac.id/wp-content/uploads/2017/08/cms_menu/journal/typo3_src-4.php/ags/rbqwx/ 326 KB
0 8800ms
8799ms Document
text/html 203.166.217.40
UBHARA-AS-ID Univ...

General

Check archive.org

Show headers Download Go to

Full URL: http://icta.ubhara.ac.id/wp-content/uploads/2017/08/cms_menu/journal/typo3_src-4.php/ags/rbqwx/?9xb9d9qd9dk0
Requested by: Host: icta.ubhara.ac.id
URL: http://icta.ubhara.ac.id/wp-content/uploads/2017/08/cms_menu/journal/typo3_src-4.php/mhwsy/yhmy/?corn=107dvq7tdy7q
Protocol: HTTP/1.1
Server: 203.166.217.40 , Indonesia, ASN45319 (UBHARA-AS-ID Universitas Bhayangkara, ID),
Reverse DNS
Software: Apache/2.2.27 (Unix) DAV/2 PHP/5.5.14 mod_ssl/2.2.27 LibreSSL/2.0 / PHP/5.5.14
Resource Hash

Request headers

Host: icta.ubhara.ac.id
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://icta.ubhara.ac.id/wp-content/uploads/2017/08/cms_menu/journal/typo3_src-4.php/mhwsy/yhmy/?corn=107dvq7tdy7q
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: http://icta.ubhara.ac.id/wp-content/uploads/2017/08/cms_menu/journal/typo3_src-4.php/mhwsy/yhmy/?corn=107dvq7tdy7q

Response headers

Date: Thu, 23 Jan 2020 14:58:10 GMT
Server: Apache/2.2.27 (Unix) DAV/2 PHP/5.5.14 mod_ssl/2.2.27 LibreSSL/2.0
X-Powered-By: PHP/5.5.14
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

GET
H2

200

jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/
Redirect Chain

http://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js

86 KB
30 KB

16ms
15ms

Script
application/javascript

2606:4700::6811:4104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js

Requested by

Host: icta.ubhara.ac.id
URL: http://icta.ubhara.ac.id/wp-content/uploads/2017/08/cms_menu/journal/typo3_src-4.php/ags/rbqwx/?9xb9d9qd9dk0

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4104 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: http://icta.ubhara.ac.id/wp-content/uploads/2017/08/cms_menu/journal/typo3_src-4.php/ags/rbqwx/?9xb9d9qd9dk0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Thu, 23 Jan 2020 14:39:17 GMT
content-encoding: br
cf-cache-status: HIT
age: 15749492
cf-ray: 559a84274c7fc2e0-FRA
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
last-modified: Wed, 01 May 2019 21:45:59 GMT
server: cloudflare
etag: W/"5cca1397-15851"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Tue, 12 Jan 2021 14:39:17 GMT
cache-control: public, max-age=30672000
timing-allow-origin: *
served-in-seconds: 0.003

Redirect headers

Location: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
Non-Authoritative-Reason: HSTS

GET
DATA 200
OK truncated
/ 8 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 739316d522834ada80b44c074610c183b02b962f01f405a73e9f00945e1f648e

Request headers

Referer: http://icta.ubhara.ac.id/wp-content/uploads/2017/08/cms_menu/journal/typo3_src-4.php/ags/rbqwx/?9xb9d9qd9dk0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 24 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6d1c61c97d0d24827499d8b1d4b963e70e689d0eda84dc688a7e4e01256233fa

Request headers

Referer: http://icta.ubhara.ac.id/wp-content/uploads/2017/08/cms_menu/journal/typo3_src-4.php/ags/rbqwx/?9xb9d9qd9dk0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ 20 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1ce69bebf4571c44d25e71ad2a146c63c6bd42b803cfbf1e168b30ebcd82317b

Request headers

Referer: http://icta.ubhara.ac.id/wp-content/uploads/2017/08/cms_menu/journal/typo3_src-4.php/ags/rbqwx/?9xb9d9qd9dk0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ 15 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2ad5c8e321d1a26b213f91e3b8f0a5390aa10574d4f26b71fdd6ed8b7b210a26

Request headers

Referer: http://icta.ubhara.ac.id/wp-content/uploads/2017/08/cms_menu/journal/typo3_src-4.php/ags/rbqwx/?9xb9d9qd9dk0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type: image/jpg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Lion's Den Scam (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
icta.ubhara.ac.id
203.166.217.40
2606:4700::6811:4104
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
1ce69bebf4571c44d25e71ad2a146c63c6bd42b803cfbf1e168b30ebcd82317b
2ad5c8e321d1a26b213f91e3b8f0a5390aa10574d4f26b71fdd6ed8b7b210a26
6d1c61c97d0d24827499d8b1d4b963e70e689d0eda84dc688a7e4e01256233fa
739316d522834ada80b44c074610c183b02b962f01f405a73e9f00945e1f648e
ca707e79a1f672c97ec17dd878cbda71d3d0a13dbb3be46feecd4f77e3b26a7a