desakutatualah-namorambe.id

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 6 HTTP transactions. The main IP is 103.103.192.12, located in Indonesia and belongs to RACKH-AS-AP Rackh Lintas Asia, pt, ID. The main domain is desakutatualah-namorambe.id.
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 5th 2020. Valid for: 3 months.

This is the only time desakutatualah-namorambe.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	103.103.192.12 103.103.192.12	135636 (RACKH-AS-...) (RACKH-AS-AP Rackh Lintas Asia)
2	54.192.207.97 54.192.207.97	16509 (AMAZON-02) (AMAZON-02)
1	139.59.164.69 139.59.164.69	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	108.163.237.178 108.163.237.178	32475 (SINGLEHOP...) (SINGLEHOP-LLC)
6	4

2 103.103.192.12 (Indonesia)

ASN135636 (RACKH-AS-AP Rackh Lintas Asia, pt, ID)
PTR: hosting-19.privatezone.net

desakutatualah-namorambe.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.192.207.97 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-192-207-97.ham50.r.cloudfront.net

d1di2lzuh97fh2.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.59.164.69 (London, United Kingdom)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: 85851-69010.cloudwaysapps.com

www.silversands.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.163.237.178 (Chicago, United States)

ASN32475 (SINGLEHOP-LLC, US)
PTR: chi-node69.websitehostserver.net

www.itrw.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	cloudfront.net d1di2lzuh97fh2.cloudfront.net	113 KB
2	desakutatualah-namorambe.id desakutatualah-namorambe.id	2 KB
1	itrw.net www.itrw.net	64 KB
1	silversands.co.uk www.silversands.co.uk	283 KB
6	4

	Domain	Requested by
2	d1di2lzuh97fh2.cloudfront.net	desakutatualah-namorambe.id d1di2lzuh97fh2.cloudfront.net
2	desakutatualah-namorambe.id	desakutatualah-namorambe.id
1	www.itrw.net	desakutatualah-namorambe.id
1	www.silversands.co.uk	desakutatualah-namorambe.id
6	4

This site contains no links.

Subject Issuer	Validity	Valid
desakutatualah-namorambe.id cPanel, Inc. Certification Authority	`2020-11-05` - `2021-02-03`	3 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2020-05-26` - `2021-04-21`	a year	crt.sh
silversands.co.uk Let's Encrypt Authority X3	`2020-10-28` - `2021-01-26`	3 months	crt.sh
*.itrw.net AlphaSSL CA - SHA256 - G2	`2020-10-21` - `2021-11-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://desakutatualah-namorambe.id/office365.htm
Frame ID: B44118EAF4EC868CB2CA35EE42768381
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

461 kB
Transfer

898 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request office365.htm Show response
desakutatualah-namorambe.id/ 3 KB
2 KB 694ms
235ms Document
text/html 103.103.192.12
RACKH-AS-AP Rackh...

General

Check archive.org

Show headers Download Go to

Full URL: https://desakutatualah-namorambe.id/office365.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.103.192.12 , Indonesia, ASN135636 (RACKH-AS-AP Rackh Lintas Asia, pt, ID),
Reverse DNS: hosting-19.privatezone.net
Software: nginx /
Resource Hash: 541779a95a5c00f1a9ee4868685233b7c271494dd838a8ee67efc195f174c0cf

Request headers

:method: GET
:authority: desakutatualah-namorambe.id
:scheme: https
:path: /office365.htm
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

server: nginx
date: Tue, 15 Dec 2020 20:55:32 GMT
content-type: text/html
last-modified: Mon, 16 Sep 2019 16:57:42 GMT
content-encoding: gzip

GET
H2 200 1g0f0h.css
d1di2lzuh97fh2.cloudfront.net/files/1g/1g0/ 486 KB
49 KB 215ms
79ms Stylesheet
text/css 54.192.207.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1di2lzuh97fh2.cloudfront.net/files/1g/1g0/1g0f0h.css?ph=7d9bff33bd
Requested by: Host: desakutatualah-namorambe.id
URL: https://desakutatualah-namorambe.id/office365.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.207.97 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-207-97.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2aab7eceb12d61aac26a9dde36be343896e4f44ba8001d308136ce1506247df6

Request headers

Referer: https://desakutatualah-namorambe.id/office365.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 18:59:21 GMT
content-encoding: gzip
last-modified: Wed, 23 Sep 2020 06:55:57 GMT
server: AmazonS3
age: 2426172
etag: "a0e95bead30d865e0568e839bea91130"
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 2b782f5f082f9e98adf8c50f24b6bb6d.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C3
accept-ranges: bytes
content-length: 50226
x-amz-cf-id: _sBadLdWDqcUQM538bzvx1Vupkirw4KUHDDR3AhS3USUbdEfWzInjg==

GET
H2 200 Gary-blog-pic-4.jpg
www.silversands.co.uk/wp-content/uploads/ 282 KB
283 KB 204ms
58ms Image
image/jpeg 139.59.164.69
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.silversands.co.uk/wp-content/uploads/Gary-blog-pic-4.jpg
Requested by: Host: desakutatualah-namorambe.id
URL: https://desakutatualah-namorambe.id/office365.htm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 139.59.164.69 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 85851-69010.cloudwaysapps.com
Software: nginx /
Resource Hash: e79ea45960041eb3fb8ac3a29d8f0a77b19f7231d1869bc78d248d9252797090

Request headers

Referer: https://desakutatualah-namorambe.id/office365.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 15 Dec 2020 20:55:33 GMT
last-modified: Fri, 18 Aug 2017 14:15:12 GMT
server: nginx
etag: "5996f670-46968"
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 289128
expires: Thu, 14 Jan 2021 20:55:33 GMT

GET
H2 200 office_365_business_plans-1.jpg
www.itrw.net/wp-content/uploads/2017/06/ 63 KB
64 KB 445ms
148ms Image
image/jpeg 108.163.237.178
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.itrw.net/wp-content/uploads/2017/06/office_365_business_plans-1.jpg

Requested by

Host: desakutatualah-namorambe.id
URL: https://desakutatualah-namorambe.id/office365.htm

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

108.163.237.178 Chicago, United States, ASN32475 (SINGLEHOP-LLC, US),

Reverse DNS

chi-node69.websitehostserver.net

Software

/

Resource Hash

99608f173de31d768ddf688c20eaf197384e31b12c686921845c6ca0d3bd466d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://desakutatualah-namorambe.id/office365.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 15 Dec 2020 20:55:32 GMT
x-content-type-options: nosniff
last-modified: Mon, 26 Jun 2017 14:42:57 GMT
etag: "fd6a-59511d71-0;;;"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
vary: User-Agent
cache-control: max-age=31536000, public
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
content-length: 64874
expires: Wed, 15 Dec 2021 20:55:32 GMT

GET
H2 404 MS365.jpg
desakutatualah-namorambe.id/url(https:/pjcourses.com/wp-content/uploads/2019/05/ 315 B
315 B 238ms
237ms Image
text/html 103.103.192.12
RACKH-AS-AP Rackh...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://desakutatualah-namorambe.id/url(https:/pjcourses.com/wp-content/uploads/2019/05/MS365.jpg
Requested by: Host: desakutatualah-namorambe.id
URL: https://desakutatualah-namorambe.id/office365.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.103.192.12 , Indonesia, ASN135636 (RACKH-AS-AP Rackh Lintas Asia, pt, ID),
Reverse DNS: hosting-19.privatezone.net
Software: nginx /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Referer: https://desakutatualah-namorambe.id/office365.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 15 Dec 2020 20:55:32 GMT
server: nginx
content-length: 315
content-type: text/html; charset=iso-8859-1

GET
H2 200 3ncu8u.woff2
d1di2lzuh97fh2.cloudfront.net/files/3n/3nc/ 63 KB
63 KB 227ms
85ms Font
application/font-woff2 54.192.207.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1di2lzuh97fh2.cloudfront.net/files/3n/3nc/3ncu8u.woff2
Requested by: Host: d1di2lzuh97fh2.cloudfront.net
URL: https://d1di2lzuh97fh2.cloudfront.net/files/1g/1g0/1g0f0h.css?ph=7d9bff33bd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.207.97 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-207-97.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1d8f5280afb7f4fa0db5cdfcb751e180788b0f0da1488309c4243ebff11a9591

Request headers

Origin: https://desakutatualah-namorambe.id
Referer: https://d1di2lzuh97fh2.cloudfront.net/files/1g/1g0/1g0f0h.css?ph=7d9bff33bd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 15 Dec 2020 19:59:12 GMT
via: 1.1 425ccbcb040dd779e5f3bdc76b6d8ff9.cloudfront.net (CloudFront)
age: 3382
x-cache: Hit from cloudfront
content-length: 64320
last-modified: Wed, 23 Sep 2020 07:20:33 GMT
server: AmazonS3
etag: "d26871e8149b5759f814fd3c7a4f784b"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C3
accept-ranges: bytes
x-amz-cf-id: ueYgB9AUvt1lqkXXji-KQPeh-UODWwbrQCgd1uyT5na18Q2nPzyhRQ==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d1di2lzuh97fh2.cloudfront.net
desakutatualah-namorambe.id
www.itrw.net
www.silversands.co.uk
103.103.192.12
108.163.237.178
139.59.164.69
54.192.207.97
1d8f5280afb7f4fa0db5cdfcb751e180788b0f0da1488309c4243ebff11a9591
2aab7eceb12d61aac26a9dde36be343896e4f44ba8001d308136ce1506247df6
541779a95a5c00f1a9ee4868685233b7c271494dd838a8ee67efc195f174c0cf
99608f173de31d768ddf688c20eaf197384e31b12c686921845c6ca0d3bd466d
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e79ea45960041eb3fb8ac3a29d8f0a77b19f7231d1869bc78d248d9252797090

desakutatualah-namorambe.id Open in urlscan Pro 103.103.192.12 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

461 kBTransfer

898 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

desakutatualah-namorambe.id Open in urlscan Pro
103.103.192.12 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

461 kB
Transfer

898 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!