kosmarpgehlpbsnsnfo01.my.id Open in urlscan Pro
103.129.221.31 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://kosmarpgehlpbsnsnfo01.my.id/checkpoint.htm
Submission: On September 16 via api (September 16th 2020, 1:51:52 am UTC) from QA

Summary HTTP 10 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 103.129.221.31, located in Indonesia and belongs to IDNIC-PAAS-AS-ID PT. Awan Kilat Semesta, ID. The main domain is kosmarpgehlpbsnsnfo01.my.id.

This is the only time kosmarpgehlpbsnsnfo01.my.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
9	103.129.221.31 103.129.221.31	138062 (IDNIC-PAA...) (IDNIC-PAAS-AS-ID PT. Awan Kilat Semesta)
1	31.13.82.35 31.13.82.35	32934 (FACEBOOK) (FACEBOOK)
10	2

9 103.129.221.31 (Indonesia)

ASN138062 (IDNIC-PAAS-AS-ID PT. Awan Kilat Semesta, ID)
PTR: iix30.cloudhost.id

kosmarpgehlpbsnsnfo01.my.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 31.13.82.35 (Ireland)

ASN32934 (FACEBOOK, US)
PTR: edge-sonar-mini-shv-01-nrt1.fbcdn.net

external-lhr3-1.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	kosmarpgehlpbsnsnfo01.my.id kosmarpgehlpbsnsnfo01.my.id	63 KB
1	fbcdn.net external-lhr3-1.xx.fbcdn.net	157 B
10	2

	Domain	Requested by
9	kosmarpgehlpbsnsnfo01.my.id	kosmarpgehlpbsnsnfo01.my.id
1	external-lhr3-1.xx.fbcdn.net	kosmarpgehlpbsnsnfo01.my.id
10	2

This site contains links to these domains. Also see Links.

Domain
www.facebook.com

Subject Issuer	Validity	Valid
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-07-21` - `2020-10-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://kosmarpgehlpbsnsnfo01.my.id/checkpoint.htm
Frame ID: 910B912AB2C0F2097F25768B6E2C1C4C
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Page Statistics

10
Requests

10 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

63 kB
Transfer

179 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/?ref=logo
Title:

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request checkpoint.htm Show response kosmarpgehlpbsnsnfo01.my.id/	5 KB 2 KB	529ms 516ms	Document text/html	103.129.221.31 IDNIC-PAAS-AS-ID ...
General Check archive.org Show headers Download Go to Full URL http://kosmarpgehlpbsnsnfo01.my.id/checkpoint.htm Protocol HTTP/1.1 Server 103.129.221.31 , Indonesia, ASN138062 (IDNIC-PAAS-AS-ID PT. Awan Kilat Semesta, ID), Reverse DNS iix30.cloudhost.id Software LiteSpeed / Resource Hash `406d213b5bcb95cbdd56b2c6752899ba362d8d4ef193af0660da730269ce2afa` Request headers Host kosmarpgehlpbsnsnfo01.my.id Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Connection Keep-Alive Content-Type text/html Last-Modified Sat, 07 Dec 2019 11:54:02 GMT Accept-Ranges bytes Content-Encoding gzip Vary Accept-Encoding Content-Length 2037 Date Wed, 16 Sep 2020 01:51:33 GMT Server LiteSpeed
GET H/1.1	200 OK	1-ko0cSbN1S2P.css kosmarpgehlpbsnsnfo01.my.id/css/	36 KB 9 KB	267ms 265ms	Stylesheet text/css	103.129.221.31 IDNIC-PAAS-AS-ID ...
General Check archive.org Show headers Download Go to Full URL http://kosmarpgehlpbsnsnfo01.my.id/css/1-ko0cSbN1S2P.css Requested by Host: kosmarpgehlpbsnsnfo01.my.id URL: http://kosmarpgehlpbsnsnfo01.my.id/checkpoint.htm Protocol HTTP/1.1 Server 103.129.221.31 , Indonesia, ASN138062 (IDNIC-PAAS-AS-ID PT. Awan Kilat Semesta, ID), Reverse DNS iix30.cloudhost.id Software LiteSpeed / Resource Hash `501237d327bb841254b036b7ec88cba61f1cbdf63856ff1df6d87c825bc506ce` Request headers Referer http://kosmarpgehlpbsnsnfo01.my.id/checkpoint.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 16 Sep 2020 01:51:33 GMT Content-Encoding gzip Last-Modified Wed, 12 Jun 2019 13:55:46 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 8894 Expires Wed, 23 Sep 2020 01:51:33 GMT
GET H/1.1	200 OK	2-fBxAYxBW8eI.css kosmarpgehlpbsnsnfo01.my.id/css/	29 KB 8 KB	529ms 515ms	Stylesheet text/css	103.129.221.31 IDNIC-PAAS-AS-ID ...
General Check archive.org Show headers Download Go to Full URL http://kosmarpgehlpbsnsnfo01.my.id/css/2-fBxAYxBW8eI.css Requested by Host: kosmarpgehlpbsnsnfo01.my.id URL: http://kosmarpgehlpbsnsnfo01.my.id/checkpoint.htm Protocol HTTP/1.1 Server 103.129.221.31 , Indonesia, ASN138062 (IDNIC-PAAS-AS-ID PT. Awan Kilat Semesta, ID), Reverse DNS iix30.cloudhost.id Software LiteSpeed / Resource Hash `9531e4a4c6eb0612dba54cd2463bdcfef8fa244191a4f772286e1de040715c03` Request headers Referer http://kosmarpgehlpbsnsnfo01.my.id/checkpoint.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 16 Sep 2020 01:51:33 GMT Content-Encoding gzip Last-Modified Wed, 12 Jun 2019 13:57:48 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 7487 Expires Wed, 23 Sep 2020 01:51:33 GMT
GET H/1.1	200 OK	3-pTiS7o2eCja.css kosmarpgehlpbsnsnfo01.my.id/css/	58 KB 10 KB	530ms 516ms	Stylesheet text/css	103.129.221.31 IDNIC-PAAS-AS-ID ...
General Check archive.org Show headers Download Go to Full URL http://kosmarpgehlpbsnsnfo01.my.id/css/3-pTiS7o2eCja.css Requested by Host: kosmarpgehlpbsnsnfo01.my.id URL: http://kosmarpgehlpbsnsnfo01.my.id/checkpoint.htm Protocol HTTP/1.1 Server 103.129.221.31 , Indonesia, ASN138062 (IDNIC-PAAS-AS-ID PT. Awan Kilat Semesta, ID), Reverse DNS iix30.cloudhost.id Software LiteSpeed / Resource Hash `5e4d9e8bb6babae78ea75acd08fb8c2fc094bc7565e15a21e793251b43b87ae6` Request headers Referer http://kosmarpgehlpbsnsnfo01.my.id/checkpoint.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 16 Sep 2020 01:51:33 GMT Content-Encoding gzip Last-Modified Tue, 03 Dec 2019 15:03:22 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 10070 Expires Wed, 23 Sep 2020 01:51:33 GMT
GET H/1.1	200 OK	4-2-9N8qo_l-I.css kosmarpgehlpbsnsnfo01.my.id/css/	17 KB 5 KB	532ms 518ms	Stylesheet text/css	103.129.221.31 IDNIC-PAAS-AS-ID ...
General Check archive.org Show headers Download Go to Full URL http://kosmarpgehlpbsnsnfo01.my.id/css/4-2-9N8qo_l-I.css Requested by Host: kosmarpgehlpbsnsnfo01.my.id URL: http://kosmarpgehlpbsnsnfo01.my.id/checkpoint.htm Protocol HTTP/1.1 Server 103.129.221.31 , Indonesia, ASN138062 (IDNIC-PAAS-AS-ID PT. Awan Kilat Semesta, ID), Reverse DNS iix30.cloudhost.id Software LiteSpeed / Resource Hash `ef774d6b935403a6fe54e3a8021093125985a0f3dd7e36aa33aaba880faa41e1` Request headers Referer http://kosmarpgehlpbsnsnfo01.my.id/checkpoint.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 16 Sep 2020 01:51:33 GMT Content-Encoding gzip Last-Modified Wed, 12 Jun 2019 16:34:52 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 4523 Expires Wed, 23 Sep 2020 01:51:33 GMT
GET H/1.1	200 OK	5-o-wil6C-n6y.css kosmarpgehlpbsnsnfo01.my.id/css/	7 KB 2 KB	535ms 521ms	Stylesheet text/css	103.129.221.31 IDNIC-PAAS-AS-ID ...
General Check archive.org Show headers Download Go to Full URL http://kosmarpgehlpbsnsnfo01.my.id/css/5-o-wil6C-n6y.css Requested by Host: kosmarpgehlpbsnsnfo01.my.id URL: http://kosmarpgehlpbsnsnfo01.my.id/checkpoint.htm Protocol HTTP/1.1 Server 103.129.221.31 , Indonesia, ASN138062 (IDNIC-PAAS-AS-ID PT. Awan Kilat Semesta, ID), Reverse DNS iix30.cloudhost.id Software LiteSpeed / Resource Hash `3ff1415445131bbbddf45c0acf3fd041340b087344a3e31629e5aa9d1ae13bad` Request headers Referer http://kosmarpgehlpbsnsnfo01.my.id/checkpoint.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 16 Sep 2020 01:51:33 GMT Content-Encoding gzip Last-Modified Wed, 12 Jun 2019 16:35:32 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 2133 Expires Wed, 23 Sep 2020 01:51:33 GMT
GET H/1.1	200 OK	F8n3WrEc0r.png kosmarpgehlpbsnsnfo01.my.id/img/	6 KB 6 KB	514ms 501ms	Image image/png	103.129.221.31 IDNIC-PAAS-AS-ID ...
General Check archive.org Show headers Download Go to Show image Full URL http://kosmarpgehlpbsnsnfo01.my.id/img/F8n3WrEc0r.png Requested by Host: kosmarpgehlpbsnsnfo01.my.id URL: http://kosmarpgehlpbsnsnfo01.my.id/checkpoint.htm Protocol HTTP/1.1 Server 103.129.221.31 , Indonesia, ASN138062 (IDNIC-PAAS-AS-ID PT. Awan Kilat Semesta, ID), Reverse DNS iix30.cloudhost.id Software LiteSpeed / Resource Hash `91252e877e09c401110e603eaf0ff8eb78f7e38c1316db14f131fcb3f896bbb4` Request headers Referer http://kosmarpgehlpbsnsnfo01.my.id/checkpoint.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 16 Sep 2020 01:51:33 GMT Last-Modified Sun, 02 Jul 2017 16:53:22 GMT Server LiteSpeed Content-Type image/png Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 6331 Expires Wed, 23 Sep 2020 01:51:33 GMT
GET H/1.1	400 Bad Request	safe_image.php external-lhr3-1.xx.fbcdn.net/	0 157 B	748ms 245ms	Image text/plain	31.13.82.35 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://external-lhr3-1.xx.fbcdn.net/safe_image.php?d=AQA2_Pb4-pLPsoDq&url=https%3A%2F%2Fpixel.facebook.com%2Fsi%2Fkappa%2F%3FKo%3Dp&_nc_hash=AQBbs84gy-QEmIJ_ Requested by Host: kosmarpgehlpbsnsnfo01.my.id URL: http://kosmarpgehlpbsnsnfo01.my.id/checkpoint.htm Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 31.13.82.35 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS edge-sonar-mini-shv-01-nrt1.fbcdn.net Software proxygen-bolt / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer http://kosmarpgehlpbsnsnfo01.my.id/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 16 Sep 2020 01:51:36 GMT Server proxygen-bolt Connection keep-alive Content-Length 0 Content-Type text/plain
GET H/1.1	404 Not Found	ccm050L6PDw.png kosmarpgehlpbsnsnfo01.my.id/rsrc.php/v3/y3/r/	1 KB 1 KB	266ms 266ms	Image text/html	103.129.221.31 IDNIC-PAAS-AS-ID ...
General Check archive.org Show headers Download Go to Show image Full URL http://kosmarpgehlpbsnsnfo01.my.id/rsrc.php/v3/y3/r/ccm050L6PDw.png Requested by Host: kosmarpgehlpbsnsnfo01.my.id URL: http://kosmarpgehlpbsnsnfo01.my.id/css/1-ko0cSbN1S2P.css Protocol HTTP/1.1 Server 103.129.221.31 , Indonesia, ASN138062 (IDNIC-PAAS-AS-ID PT. Awan Kilat Semesta, ID), Reverse DNS iix30.cloudhost.id Software LiteSpeed / Resource Hash `79ce4e2bbf25c4a4d91458d191d6ef268b4592169ae6586ba52242f412670b5d` Request headers Referer http://kosmarpgehlpbsnsnfo01.my.id/css/1-ko0cSbN1S2P.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Wed, 16 Sep 2020 01:51:34 GMT Cache-Control private, no-cache, no-store, must-revalidate, max-age=0 Server LiteSpeed Connection Keep-Alive Content-Length 1237 Content-Type text/html
GET H/1.1	200 OK	security.png kosmarpgehlpbsnsnfo01.my.id/img/	19 KB 19 KB	265ms 264ms	Image image/png	103.129.221.31 IDNIC-PAAS-AS-ID ...
General Check archive.org Show headers Download Go to Show image Full URL http://kosmarpgehlpbsnsnfo01.my.id/img/security.png Requested by Host: kosmarpgehlpbsnsnfo01.my.id URL: http://kosmarpgehlpbsnsnfo01.my.id/css/3-pTiS7o2eCja.css Protocol HTTP/1.1 Server 103.129.221.31 , Indonesia, ASN138062 (IDNIC-PAAS-AS-ID PT. Awan Kilat Semesta, ID), Reverse DNS iix30.cloudhost.id Software LiteSpeed / Resource Hash `e22f0b443102814b944012f560c353732076fcc03e49455720c66c49e7c833f5` Request headers Referer http://kosmarpgehlpbsnsnfo01.my.id/css/3-pTiS7o2eCja.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 16 Sep 2020 01:51:34 GMT Last-Modified Wed, 12 Jun 2019 16:19:00 GMT Server LiteSpeed Content-Type image/png Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 19461 Expires Wed, 23 Sep 2020 01:51:34 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

external-lhr3-1.xx.fbcdn.net
kosmarpgehlpbsnsnfo01.my.id
103.129.221.31
31.13.82.35
3ff1415445131bbbddf45c0acf3fd041340b087344a3e31629e5aa9d1ae13bad
406d213b5bcb95cbdd56b2c6752899ba362d8d4ef193af0660da730269ce2afa
501237d327bb841254b036b7ec88cba61f1cbdf63856ff1df6d87c825bc506ce
5e4d9e8bb6babae78ea75acd08fb8c2fc094bc7565e15a21e793251b43b87ae6
79ce4e2bbf25c4a4d91458d191d6ef268b4592169ae6586ba52242f412670b5d
91252e877e09c401110e603eaf0ff8eb78f7e38c1316db14f131fcb3f896bbb4
9531e4a4c6eb0612dba54cd2463bdcfef8fa244191a4f772286e1de040715c03
e22f0b443102814b944012f560c353732076fcc03e49455720c66c49e7c833f5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef774d6b935403a6fe54e3a8021093125985a0f3dd7e36aa33aaba880faa41e1

kosmarpgehlpbsnsnfo01.my.id Open in urlscan Pro 103.129.221.31 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

10 Requests

10 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

63 kBTransfer

179 kBSize

0 Cookies

1 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

kosmarpgehlpbsnsnfo01.my.id Open in urlscan Pro
103.129.221.31 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

10 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

63 kB
Transfer

179 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!