ptm.untirta.ac.id - urlscan.io

Summary

This website contacted 4 IPs in 4 countries across 5 domains to perform 4 HTTP transactions. The main IP is 103.142.195.252, located in Serang, Indonesia and belongs to IDNIC-UNTIRTA-AS-ID Universitas Sultan Ageng Tirtayasa, ID. The main domain is ptm.untirta.ac.id.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on May 12th 2022. Valid for: a year.

This is the only time ptm.untirta.ac.id was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	84.205.225.110 84.205.225.110	35506 (SYZEFXIS) (SYZEFXIS)
1	185.30.32.121 185.30.32.121	48324 (DE-WEBGO ...) (DE-WEBGO www.webgo.de)
1	103.142.195.252 103.142.195.252	139377 (IDNIC-UNT...) (IDNIC-UNTIRTA-AS-ID Universitas Sultan Ageng Tirtayasa)
1	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	4

1 84.205.225.110 (Athens, Greece) 1 redirects

ASN35506 (SYZEFXIS, GR)
PTR: login.ermis.gov.gr

login.ermis.gov.gr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.30.32.121 (Germany)

ASN48324 (DE-WEBGO www.webgo.de, DE)
PTR: s121.goserver.host

heizung-sanitaer-artmeier.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 103.142.195.252 (Serang, Indonesia)

ASN139377 (IDNIC-UNTIRTA-AS-ID Universitas Sultan Ageng Tirtayasa, ID)
PTR: sejarah.untirta.ac.id

ptm.untirta.ac.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 201	29 KB
1	untirta.ac.id ptm.untirta.ac.id	2 KB
1	heizung-sanitaer-artmeier.de heizung-sanitaer-artmeier.de	216 B
1	ermis.gov.gr 1 redirects login.ermis.gov.gr	831 B
0	animatelearning.co Failed animatelearning.co Failed
4	5

	Domain	Requested by
1	cdnjs.cloudflare.com	heizung-sanitaer-artmeier.de
1	ptm.untirta.ac.id
1	heizung-sanitaer-artmeier.de
1	login.ermis.gov.gr	1 redirects
0	animatelearning.co Failed	cdnjs.cloudflare.com
4	5

This site contains no links.

Subject Issuer	Validity	Valid
heizung-sanitaer-artmeier.de R3	`2022-10-24` - `2023-01-22`	3 months	crt.sh
untirta.ac.id Sectigo RSA Organization Validation Secure Server CA	`2022-05-12` - `2023-06-11`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://ptm.untirta.ac.id/wordpress/rlogin.microsoft.html
Frame ID: D537F879D509582B7D68C7CC61C7D2F2
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your Microsoft account

Page URL History Show full URLs

https://login.ermis.gov.gr/pls/orasso/orasso.wwctx_app_language.set_language?p_http_language=fr-fr&p_nl... HTTP 302
https://heizung-sanitaer-artmeier.de/wp-content/themes/doc.html Page URL
https://ptm.untirta.ac.id/wordpress/rlogin.microsoft.html Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

4
Requests

75 %
HTTPS

25 %
IPv6

5
Domains

5
Subdomains

4
IPs

4
Countries

31 kB
Transfer

93 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://login.ermis.gov.gr/pls/orasso/orasso.wwctx_app_language.set_language?p_http_language=fr-fr&p_nls_language=f&p_nlS_territory=france&p_requested_url=https://heizung-sanitaer-artmeier.de/wp-content/themes/doc.html HTTP 302
https://heizung-sanitaer-artmeier.de/wp-content/themes/doc.html Page URL
https://ptm.untirta.ac.id/wordpress/rlogin.microsoft.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://login.ermis.gov.gr/pls/orasso/orasso.wwctx_app_language.set_language?p_http_language=fr-fr&p_nls_language=f&p_nlS_territory=france&p_requested_url=https://heizung-sanitaer-artmeier.de/wp-content/themes/doc.html HTTP 302
https://heizung-sanitaer-artmeier.de/wp-content/themes/doc.html

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

doc.html Show response
heizung-sanitaer-artmeier.de/wp-content/themes/
Redirect Chain

https://login.ermis.gov.gr/pls/orasso/orasso.wwctx_app_language.set_language?p_http_language=fr-fr&p_nls_language=f&p_nlS_territory=france&p_requested_url=https://heizung-sanitaer-artmeier.de/wp-co...
https://heizung-sanitaer-artmeier.de/wp-content/themes/doc.html

102 B
216 B

127ms
32ms

Document
text/html

185.30.32.121
DE-WEBGO www.webg...

General

Check archive.org

Show headers Download Go to

Full URL: https://heizung-sanitaer-artmeier.de/wp-content/themes/doc.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.30.32.121 , Germany, ASN48324 (DE-WEBGO www.webgo.de, DE),
Reverse DNS: s121.goserver.host
Software: nginx /
Resource Hash: 32d95511b490dcfca09f82e6b6c360f6dcbbf0c9327caa94c2738f31b055a3cd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 16 Nov 2022 01:30:02 GMT
server: nginx
vary: Accept-Encoding

Redirect headers

Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Wed, 16 Nov 2022 01:30:02 GMT
Keep-Alive: timeout=300, max=999
Location: https://heizung-sanitaer-artmeier.de/wp-content/themes/doc.html
Server: Oracle-Application-Server-10g/10.1.2.2.0 Oracle-HTTP-Server OracleAS-Web-Cache-10g/10.1.2.3.0 (N;ecid=72058009860467013,0)

GET
H2 200 Primary Request rlogin.microsoft.html Show response
ptm.untirta.ac.id/wordpress/ 2 KB
2 KB 3056ms
1048ms Document
text/html 103.142.195.252
IDNIC-UNTIRTA-AS-...

General

Check archive.org

Show headers Download Go to

Full URL: https://ptm.untirta.ac.id/wordpress/rlogin.microsoft.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.142.195.252 Serang, Indonesia, ASN139377 (IDNIC-UNTIRTA-AS-ID Universitas Sultan Ageng Tirtayasa, ID),
Reverse DNS: sejarah.untirta.ac.id
Software: Apache/2 /
Resource Hash: e816c660a4117d0085ac8aa8268d3e1375f8b82c19af6cc729c45f6bf78cff30

Request headers

Referer: https://heizung-sanitaer-artmeier.de/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 1558
content-type: text/html
date: Wed, 16 Nov 2022 01:30:04 GMT
etag: "7e5-5ed6a3e99ac44-gzip"
last-modified: Mon, 14 Nov 2022 08:44:16 GMT
server: Apache/2
vary: Accept-Encoding,User-Agent

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/ 90 KB
29 KB 57ms
23ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.min.js

Requested by

Host: heizung-sanitaer-artmeier.de
URL: https://heizung-sanitaer-artmeier.de/wp-content/themes/doc.html

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://ptm.untirta.ac.id/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 16 Nov 2022 01:30:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 442568
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 29363
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-169d5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Bey510ZrWvBkLpM53W3AE3etIGgmF6YD%2Bc%2BuvOfaL0OqUd%2By9XIOos3Me58FcA8aCS1b7PelbJqX6nQR%2B2axet6iizlmPKJLCQa%2F2ekLN1cmM%2BzYIyv4MrZx1W5CrlcKngMf3euddR9uX1LnT4LX%2Ff%2By"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 76ac7599acf4924a-FRA
expires: Mon, 06 Nov 2023 01:30:05 GMT

POST __-__.php
animatelearning.co/js/rsh/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: animatelearning.co
URL: https://animatelearning.co/js/rsh/__-__.php?_do=layout&email=[email]

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
login.ermis.gov.gr/	1969-12-31 23:59:59	Name: orasso Value: 9.0.3+fr-fr+f+FRANCE+ED8D3E13D7CC7100E05400144FAFABEA+D8CB3E4B681155D901F8DF7D9A68FDD93E31A9F6C39C97B56BAEEA1B049B448D2129B447D90348E29F1D2A23D7AB677E9DBA7A592BAD0207D7295FBF549BC625A80CA244463DE1AED7F4B1BCB9FCD1DDD9211DF8497D1B01
login.ermis.gov.gr/	1970-01-20 16:15:34	Name: LOGIN_NLS Value: fr-fr
login.ermis.gov.gr/	1969-12-31 23:59:59	Name: NSC_mphjo.fsnjt-443-wjq Value: ffffffffc3a0150145525d5f4f58455e445a4a422853

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

animatelearning.co
cdnjs.cloudflare.com
heizung-sanitaer-artmeier.de
login.ermis.gov.gr
ptm.untirta.ac.id
animatelearning.co
103.142.195.252
185.30.32.121
2606:4700::6811:190e
84.205.225.110
32d95511b490dcfca09f82e6b6c360f6dcbbf0c9327caa94c2738f31b055a3cd
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
e816c660a4117d0085ac8aa8268d3e1375f8b82c19af6cc729c45f6bf78cff30

ptm.untirta.ac.id Open in urlscan Pro 103.142.195.252 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

75 %HTTPS

25 %IPv6

5 Domains

5 Subdomains

4 IPs

4 Countries

31 kBTransfer

93 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

3 Cookies

2 Console Messages

Indicators

ptm.untirta.ac.id Open in urlscan Pro
103.142.195.252 Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

75 %
HTTPS

25 %
IPv6

5
Domains

5
Subdomains

4
IPs

4
Countries

31 kB
Transfer

93 kB
Size

3
Cookies

4 HTTP transactions
0 data transactions