mail.nonton-bkpgc5t.szky.my.id Open in urlscan Pro
2606:4700:3033::ac43:d687  Malicious Activity! Public Scan

Submitted URL: http://mail.nonton-bkpgc5t.szky.my.id/
Effective URL: http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/
Submission: On July 27 via api from US — Scanned from US

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 10 HTTP transactions. The main IP is 2606:4700:3033::ac43:d687, located in United States and belongs to CLOUDFLARENET, US. The main domain is mail.nonton-bkpgc5t.szky.my.id.
This is the only time mail.nonton-bkpgc5t.szky.my.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Gaming (Entertainment)

Domain & IP information

IP Address AS Autonomous System
1 6 2606:4700:303... 13335 (CLOUDFLAR...)
1 159.65.12.209 14061 (DIGITALOC...)
1 2606:6680:10:... 40676 (AS40676)
1 104.243.38.177 23470 (RELIABLESITE)
1 2a04:4e42:600... 54113 (FASTLY)
10 6
Apex Domain
Subdomains
Transfer
6 szky.my.id
mail.nonton-bkpgc5t.szky.my.id
71 KB
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 361
42 KB
1 ibb.co
i.ibb.co — Cisco Umbrella Rank: 11053
9 KB
1 im.ge
i.im.ge — Cisco Umbrella Rank: 277984
28 KB
1 alfascorpii.co.id
m.alfascorpii.co.id
6 KB
10 5
Domain Requested by
6 mail.nonton-bkpgc5t.szky.my.id 1 redirects mail.nonton-bkpgc5t.szky.my.id
1 cdn.jsdelivr.net mail.nonton-bkpgc5t.szky.my.id
1 i.ibb.co mail.nonton-bkpgc5t.szky.my.id
1 i.im.ge mail.nonton-bkpgc5t.szky.my.id
1 m.alfascorpii.co.id mail.nonton-bkpgc5t.szky.my.id
10 5

This site contains no links.

Subject Issuer Validity Valid
m.alfascorpii.co.id
R3
2023-05-02 -
2023-07-31
3 months crt.sh
image.01.cdn.im.ge
Sectigo RSA Domain Validation Secure Server CA
2023-06-21 -
2024-06-21
a year crt.sh
i.ibb.co
R3
2023-06-11 -
2023-09-09
3 months crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2022 Q4
2022-12-23 -
2024-01-24
a year crt.sh

This page contains 1 frames:

Primary Page: http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/
Frame ID: 7AFD2914EF21EB1C402091E3F65D6900
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

Vidio - Nonton Tv Streaming, Serial, Sinetron & Sepak Bola | Vidio

Page URL History Show full URLs

  1. http://mail.nonton-bkpgc5t.szky.my.id/ Page URL
  2. http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1 HTTP 301
    http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

10
Requests

40 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

6
IPs

2
Countries

156 kB
Transfer

3883 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://mail.nonton-bkpgc5t.szky.my.id/ Page URL
  2. http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1 HTTP 301
    http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
mail.nonton-bkpgc5t.szky.my.id/
111 B
785 B
Document
General
Full URL
http://mail.nonton-bkpgc5t.szky.my.id/
Protocol
HTTP/1.1
Server
2606:4700:3033::ac43:d687 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

CF-Cache-Status
DYNAMIC
CF-RAY
7ed6a7795a95c33b-EWR
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Thu, 27 Jul 2023 17:38:21 GMT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LKTFT6tLqRzzLCn1RgC7tztwmOuXBwgpSO1xTAGkHZIgYigxUuhhaWf9Bd8jGzIIgSCaARODBH5ojmts67ibj9HX2gopaH%2FYxQuUhAGioygkMg%2BlzgXG%2F%2Fv4AnizF1attMgOPFZAQ26UjQedigXypKIPud%2Fh%2FpH%2FqH5pyR4%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
alt-svc
h3=":443"; ma=86400
Primary Request /
mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/
Redirect Chain
  • http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1
  • http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/
9 KB
3 KB
Document
General
Full URL
http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/
Protocol
HTTP/1.1
Server
2606:4700:3033::ac43:d687 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4e1882bf796839321c2252bc09fd8176fbc5e924c2584b5d2e9e2734a8e78739

Request headers

Referer
http://mail.nonton-bkpgc5t.szky.my.id/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

CF-Cache-Status
DYNAMIC
CF-RAY
7ed6a7dabeddc33b-EWR
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Thu, 27 Jul 2023 17:38:22 GMT
Last-Modified
Thu, 24 Nov 2022 01:42:46 GMT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cjL5QESlUZJq8tuOp4ODwnJvsXJprmciYVdFlicSaCcyEog0vchvaDPNPE7UOuK%2FGdmE4rmvDdV%2BgUhXRW6tTL975PeRBMManm8n1ZLDWhAdyaaFPgbD%2BiRPJGNMfp7qx1C6jhaUKCLWNR7m12IdFyKP0dODH9vPXMFCKdU%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
alt-svc
h3=":443"; ma=86400

Redirect headers

CF-Cache-Status
DYNAMIC
CF-RAY
7ed6a7d3e92ac33b-EWR
Connection
keep-alive
Content-Type
text/html; charset=iso-8859-1
Date
Thu, 27 Jul 2023 17:38:22 GMT
Location
http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=en%2B0W3ESG0nff9WR7KyBGtrgjFEnq9tpbudX7G2EHMf79RCLaFmilbhEQEJYNSrqw8F3LQ3rs2kb%2BQKS4mZjRioEG3vjaAL9Pt7Aj2mrCxt0vA5ei25w1d4ZnYVPnETTS%2FMvSICUqg2pVOz3a6S3h3bH57nQF7L%2BaSIRuBE%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
alt-svc
h3=":443"; ma=86400
style.css
mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/css/
0
0

fb_login.png
m.alfascorpii.co.id/web_lib/img/
6 KB
6 KB
Image
General
Full URL
https://m.alfascorpii.co.id/web_lib/img/fb_login.png
Requested by
Host: mail.nonton-bkpgc5t.szky.my.id
URL: http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
159.65.12.209 , Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.15 /
Resource Hash
8c595d8b5b209a8d02eb84f0d9097fbdcab284a91bbbab5353cbdc7e9b1c0a6c

Request headers

accept-language
en-US,en;q=0.9
Referer
http://mail.nonton-bkpgc5t.szky.my.id/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date
Thu, 27 Jul 2023 17:38:24 GMT
Last-Modified
Thu, 28 Feb 2019 16:03:23 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.15
ETag
"184b-582f66e12d13b"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
6219
Tw3QNy.png
i.im.ge/2021/09/15/
28 KB
28 KB
Image
General
Full URL
https://i.im.ge/2021/09/15/Tw3QNy.png
Requested by
Host: mail.nonton-bkpgc5t.szky.my.id
URL: http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:6680:10:1::3c7c:8d7 , United States, ASN40676 (AS40676, US),
Reverse DNS
Software
nginx/1.22.0 /
Resource Hash
092a3cd5f86b3f039feefdeb86694cd16ae545af214cfda614bdbbe2d1bde401

Request headers

accept-language
en-US,en;q=0.9
Referer
http://mail.nonton-bkpgc5t.szky.my.id/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-amz-meta-mtime
1631696336.783
date
Thu, 27 Jul 2023 17:03:06 GMT
last-modified
Tue, 07 Jun 2022 12:52:13 GMT
server
nginx/1.22.0
age
2117
content-type
image/png
access-control-expose-headers
Content-Disposition
cache-control
max-age=3600, public
content-disposition
inline; filename="Tw3QNy.png"
accept-ranges
bytes
content-length
28789
expires
Thu, 27 Jul 2023 17:51:04 GMT
logofbb-removebg-preview.png
i.ibb.co/ThFWLfQ/
9 KB
9 KB
Image
General
Full URL
https://i.ibb.co/ThFWLfQ/logofbb-removebg-preview.png
Requested by
Host: mail.nonton-bkpgc5t.szky.my.id
URL: http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.243.38.177 Wilmington, United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
disuanqi.dadongeng.cn
Software
nginx /
Resource Hash
01de96097767803667b379b75c967fb1917eab1910a7a1e4288254930d992fae

Request headers

accept-language
en-US,en;q=0.9
Referer
http://mail.nonton-bkpgc5t.szky.my.id/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date
Thu, 27 Jul 2023 17:38:23 GMT
last-modified
Mon, 18 Jul 2022 08:52:12 GMT
server
nginx
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
8979
expires
Thu, 31 Dec 2037 23:55:55 GMT
slim.js
cdn.jsdelivr.net/gh/stylesheett/jquery.min.js/
178 KB
42 KB
Script
General
Full URL
https://cdn.jsdelivr.net/gh/stylesheett/jquery.min.js/slim.js
Requested by
Host: mail.nonton-bkpgc5t.szky.my.id
URL: http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
30fd54eee527bda253b3f9c77b8bf581954036ea99bd8af3643a4ebf87b5b409
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-US,en;q=0.9
Referer
http://mail.nonton-bkpgc5t.szky.my.id/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 27 Jul 2023 17:38:23 GMT
x-content-type-options
nosniff
content-encoding
br
age
19653
x-jsd-version
master
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
42436
x-served-by
cache-fra-eddf8230135-FRA, cache-nyc-kteb1890060-NYC
x-jsd-version-type
branch
etag
W/"2c68c-0mnOY3Agc98IzSXRzjVvoPyAYF4"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
1.mp4
mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/media/
37 KB
0
Media
General
Full URL
http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/media/1.mp4
Requested by
Host: mail.nonton-bkpgc5t.szky.my.id
URL: http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/
Protocol
HTTP/1.1
Server
2606:4700:3033::ac43:d687 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Range
bytes=0-

Response headers

Date
Thu, 27 Jul 2023 17:38:22 GMT
CF-Cache-Status
HIT
Last-Modified
Mon, 15 Nov 2021 21:00:26 GMT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server
cloudflare
Age
3429
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x82zB5p5Sql6a%2FUkGo5YUXUbX3qh9nV26KTKmzmDvXaZgbsDOWVrWpBty3anm7hcBbBZgrS2EH1TG%2BASU3dGTbe6vxQrMkYUYMQjE9pmzLqlvh0usJOw2p6Cy3aT0LlVs%2BTFxYhRQqlBcXtilRMeh%2BqsustnTgDShk9D3Z4%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
video/mp4
Content-Range
bytes 0-5375070/5375071
Cache-Control
max-age=14400
Connection
keep-alive
CF-RAY
7ed6a7dd9cec1861-EWR
alt-svc
h3=":443"; ma=86400
Content-Length
5375071
1.mp4
mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/media/
65 KB
66 KB
Media
General
Full URL
http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/media/1.mp4
Requested by
Host: mail.nonton-bkpgc5t.szky.my.id
URL: http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/
Protocol
HTTP/1.1
Server
2606:4700:3033::ac43:d687 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9b3950f97da1f577c9804a4a33f20e8fd0de07e4c86b836487fee5857b09266d

Request headers

Referer
http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Range
bytes=5308416-

Response headers

Date
Thu, 27 Jul 2023 17:38:23 GMT
CF-Cache-Status
HIT
Last-Modified
Mon, 15 Nov 2021 21:00:26 GMT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server
cloudflare
Age
44
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hJ8PIQNGmU4rsQ0c0n7ZQ%2B%2B83TPOi3ANaoOB53lh%2BAHHV6gxnSy95fWNCYK9SK4CSmOovI3Lu75CXSANBiKWlZkY%2FGvlB9janRwhsw7UJQGEDuUJvbtHtP8hGLkvICnhmPelM%2FtiXsNoftYcswtCu%2FfospoYf%2F0uN5JBXLY%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
video/mp4
Content-Range
bytes 5308416-5375070/5375071
Cache-Control
max-age=14400
Connection
keep-alive
CF-RAY
7ed6a7de2ec441d2-EWR
alt-svc
h3=":443"; ma=86400
Content-Length
66655
1.mp4
mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/media/
3 MB
0
Media
General
Full URL
http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/media/1.mp4
Requested by
Host: mail.nonton-bkpgc5t.szky.my.id
URL: http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/
Protocol
HTTP/1.1
Server
2606:4700:3033::ac43:d687 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Range
bytes=32768-

Response headers

Date
Thu, 27 Jul 2023 17:38:23 GMT
CF-Cache-Status
HIT
Last-Modified
Mon, 15 Nov 2021 21:00:26 GMT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server
cloudflare
Age
44
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BRojDZhnmXIt9RnZ4Nlk0p22MZH8zALBTepMoZgDl4UWPq6aTAfhLE%2BEXb%2FCW%2BntRshhqEQcdij46Qf2ICmGbquKjX8QwLzZDVrXi7plMYhaoMmNxv1LwigRg%2Fji%2BdANJpuP9%2Be78w9k%2BFET%2B68uQ0EdlfXzNsE4NMe8myg%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
video/mp4
Content-Range
bytes 32768-5375070/5375071
Cache-Control
max-age=14400
Connection
keep-alive
CF-RAY
7ed6a7decf8b41d2-EWR
alt-svc
h3=":443"; ma=86400
Content-Length
5342303

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
mail.nonton-bkpgc5t.szky.my.id
URL
http://mail.nonton-bkpgc5t.szky.my.id/vhsfhqpdhdxih1/css/style.css

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Gaming (Entertainment)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies