sentraki.umg.ac.id Open in urlscan Pro
139.255.94.86  Malicious Activity! Public Scan

URL: http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
Submission: On February 14 via automatic, source openphish

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 139.255.94.86, located in Indonesia and belongs to LINKNET-ID-AP Linknet ASN, ID. The main domain is sentraki.umg.ac.id.
This is the only time sentraki.umg.ac.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banque Populaire (Banking)

Domain & IP information

IP Address AS Autonomous System
8 139.255.94.86 9905 (LINKNET-I...)
1 91.198.174.208 14907 (WIKIMEDIA)
9 2
Apex Domain
Subdomains
Transfer
8 umg.ac.id
sentraki.umg.ac.id
864 KB
1 wikimedia.org
upload.wikimedia.org
73 KB
9 2
Domain Requested by
8 sentraki.umg.ac.id sentraki.umg.ac.id
1 upload.wikimedia.org sentraki.umg.ac.id
9 2

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
Frame ID: (88EB8DED06679B058A0AC8D3AC1C53B7)
Requests: 9 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
  • headers server /php\/?([\d.]+)?/i

Overall confidence: 100%
Detected patterns
  • headers server /CentOS/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

9
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

938 kB
Transfer

935 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request final.php
sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/
18 KB
19 KB
Document
General
Full URL
http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
Protocol
HTTP/1.1
Server
139.255.94.86 , Indonesia, ASN9905 (LINKNET-ID-AP Linknet ASN, ID),
Reverse DNS
ln-static-139-255-94-86.link.net.id
Software
Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3 / PHP/5.3.3
Resource Hash
539c14090a17b40f60f82ae27e1a469aa46e4fd0e779e0700da33a2aad01c609

Request headers

Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Connection
keep-alive
Accept-Encoding
gzip, deflate
Host
sentraki.umg.ac.id
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 14 Feb 2018 09:17:07 GMT
Server
Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3
Connection
close
X-Powered-By
PHP/5.3.3
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
authentication.js
sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/js/
0
0
Script
General
Full URL
http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/js/authentication.js
Requested by
Host: sentraki.umg.ac.id
URL: http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
Protocol
HTTP/1.1
Server
139.255.94.86 , Indonesia, ASN9905 (LINKNET-ID-AP Linknet ASN, ID),
Reverse DNS
ln-static-139-255-94-86.link.net.id
Software
Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3 /
Resource Hash

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
sentraki.umg.ac.id
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 14 Feb 2018 09:17:08 GMT
Server
Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3
Connection
close
Content-Length
476
Content-Type
text/html; charset=iso-8859-1
1011px-Banquepopulaire_logo.svg.png
upload.wikimedia.org/wikipedia/fr/thumb/2/22/Banquepopulaire_logo.svg/
72 KB
73 KB
Image
General
Full URL
https://upload.wikimedia.org/wikipedia/fr/thumb/2/22/Banquepopulaire_logo.svg/1011px-Banquepopulaire_logo.svg.png
Requested by
Host: sentraki.umg.ac.id
URL: http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
Protocol
SPDY
Server
91.198.174.208 , Netherlands, ASN14907 (WIKIMEDIA - Wikimedia Foundation Inc., US),
Reverse DNS
upload-lb.esams.wikimedia.org
Software
/
Resource Hash
f1c2d8ca2927b0dd834418f42b89c04b92e95926bcc32243c768ab99f1707082
Security Headers
Name Value
Strict-Transport-Security max-age=106384710; includeSubDomains; preload

Request headers

Referer
http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-analytics
https=1;nocookies=1
date
Wed, 14 Feb 2018 09:10:43 GMT
via
1.1 varnish-v4, 1.1 varnish (Varnish/5.1), 1.1 varnish (Varnish/5.1)
x-content-security-policy-report-only
default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; media-src data:; sandbox; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&
age
56002
x-cache-status
hit-front
content-security-policy-report-only
default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; media-src data:; sandbox; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&
x-cache
cp1064 pass, cp3047 hit/14, cp3038 hit/4
status
200
content-length
73777
content-disposition
inline;filename*=UTF-8''Banquepopulaire_logo.svg.png
x-trans-id
tx8b78673ce1d943338087c-005a832250
x-client-ip
148.251.45.254
x-object-meta-sha1base36
cp6zteoy7du6i63y01met0fxcjrjdif
timing-allow-origin
*
last-modified
Tue, 15 Jul 2014 08:20:15 GMT
etag
76efb1a07d7093160098258b91c4616a
x-webkit-csp-report-only
default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; media-src data:; sandbox; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&
strict-transport-security
max-age=106384710; includeSubDomains; preload
x-varnish
100245144, 274835890 219797907, 76677751 47759522
access-control-allow-origin
*
x-timestamp
1405412414.04851
accept-ranges
bytes
content-type
image/png
access-control-expose-headers
Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache, X-Varnish
cp.png
sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/
56 KB
56 KB
Image
General
Full URL
http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/cp.png
Requested by
Host: sentraki.umg.ac.id
URL: http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
Protocol
HTTP/1.1
Server
139.255.94.86 , Indonesia, ASN9905 (LINKNET-ID-AP Linknet ASN, ID),
Reverse DNS
ln-static-139-255-94-86.link.net.id
Software
Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3 /
Resource Hash
adc948c51bf75746584855ba175e7b36dc7d1e3edd835a179c3b1ab0ae3567e3

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
sentraki.umg.ac.id
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 14 Feb 2018 09:17:08 GMT
Last-Modified
Tue, 13 Feb 2018 08:26:27 GMT
Server
Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3
ETag
"102dc4-deca-56513c040319b"
Content-Type
image/png
Connection
close
Accept-Ranges
bytes
Content-Length
57034
btn_ok_off.png
sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/
15 KB
16 KB
Image
General
Full URL
http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/btn_ok_off.png
Requested by
Host: sentraki.umg.ac.id
URL: http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
Protocol
HTTP/1.1
Server
139.255.94.86 , Indonesia, ASN9905 (LINKNET-ID-AP Linknet ASN, ID),
Reverse DNS
ln-static-139-255-94-86.link.net.id
Software
Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3 /
Resource Hash
5b32e9e5bded1d86d15d942353312058b422b205640ed915f29b526da95f3b42

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
sentraki.umg.ac.id
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 14 Feb 2018 09:17:08 GMT
Last-Modified
Tue, 13 Feb 2018 08:26:27 GMT
Server
Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3
ETag
"102dc3-3dd4-56513c040319b"
Content-Type
image/png
Connection
close
Accept-Ranges
bytes
Content-Length
15828
back.png
sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/
772 KB
773 KB
Image
General
Full URL
http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/back.png
Requested by
Host: sentraki.umg.ac.id
URL: http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
Protocol
HTTP/1.1
Server
139.255.94.86 , Indonesia, ASN9905 (LINKNET-ID-AP Linknet ASN, ID),
Reverse DNS
ln-static-139-255-94-86.link.net.id
Software
Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3 /
Resource Hash
f74dc07095770d5873071f93395a8fb12507a38780921158560660dbe880670d

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
sentraki.umg.ac.id
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 14 Feb 2018 09:17:08 GMT
Last-Modified
Tue, 13 Feb 2018 08:26:27 GMT
Server
Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3
ETag
"102dc2-c10fc-56513c0402db3"
Content-Type
image/png
Connection
close
Accept-Ranges
bytes
Content-Length
790780
ar_h.gif
sentraki.umg.ac.id/banquebp/pop/imgs/imagesTemplates/
459 B
459 B
Image
General
Full URL
http://sentraki.umg.ac.id/banquebp/pop/imgs/imagesTemplates/ar_h.gif
Requested by
Host: sentraki.umg.ac.id
URL: http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
Protocol
HTTP/1.1
Server
139.255.94.86 , Indonesia, ASN9905 (LINKNET-ID-AP Linknet ASN, ID),
Reverse DNS
ln-static-139-255-94-86.link.net.id
Software
Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3 /
Resource Hash
0a356dd495db8872511e1487bd975457a9a6ce7084cb0e7b5bf85692f1349108

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
sentraki.umg.ac.id
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 14 Feb 2018 09:17:08 GMT
Server
Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3
Connection
close
Content-Length
459
Content-Type
text/html; charset=iso-8859-1
ar_b.gif
sentraki.umg.ac.id/banquebp/pop/imgs/imagesTemplates/
459 B
459 B
Image
General
Full URL
http://sentraki.umg.ac.id/banquebp/pop/imgs/imagesTemplates/ar_b.gif
Requested by
Host: sentraki.umg.ac.id
URL: http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
Protocol
HTTP/1.1
Server
139.255.94.86 , Indonesia, ASN9905 (LINKNET-ID-AP Linknet ASN, ID),
Reverse DNS
ln-static-139-255-94-86.link.net.id
Software
Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3 /
Resource Hash
bc7406b92b79e6e745c22983fefad4786d5fc402050d64d21fe60c51547e3176

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
sentraki.umg.ac.id
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 14 Feb 2018 09:17:08 GMT
Server
Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3
Connection
close
Content-Length
459
Content-Type
text/html; charset=iso-8859-1
fl_b.png
sentraki.umg.ac.id/banquebp/pop/imgs/imagesTemplates/
459 B
459 B
Image
General
Full URL
http://sentraki.umg.ac.id/banquebp/pop/imgs/imagesTemplates/fl_b.png
Requested by
Host: sentraki.umg.ac.id
URL: http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
Protocol
HTTP/1.1
Server
139.255.94.86 , Indonesia, ASN9905 (LINKNET-ID-AP Linknet ASN, ID),
Reverse DNS
ln-static-139-255-94-86.link.net.id
Software
Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3 /
Resource Hash
8d36eb4d55700f00480affcb15f50e59e30fc257a7390fc99a173e745deefc69

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
sentraki.umg.ac.id
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://sentraki.umg.ac.id/banquebp/pop/cyberplusauthentification/final.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 14 Feb 2018 09:17:08 GMT
Server
Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3
Connection
close
Content-Length
459
Content-Type
text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banque Populaire (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| _csrff_cancel_onload_ object| _csrf_ object| _tsbp_ function| onLoadEvent undefined| frmvalidator

0 Cookies