jawatankosong2023.my.id Open in urlscan Pro
103.250.10.246  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response jawatankosong2023.my.id/23/	9 KB 9 KB	2608ms 289ms	Document text/html	103.250.10.246 CLOUDHOST-AS-AP C...
General Check archive.org Show headers Download Go to Full URL http://jawatankosong2023.my.id/23/ Protocol HTTP/1.1 Server 103.250.10.246 , Indonesia, ASN138608 (CLOUDHOST-AS-AP Cloud Host Pte Ltd, SG), Reverse DNS rulzprivateserver.godd.my.id Software Apache / Resource Hash 5eef5a20cab4db0ee6f8ec9a73f0029c3eb07aa54cae7266be60780bbe5e6bee Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Tue, 22 Aug 2023 06:23:18 GMT Keep-Alive timeout=5, max=100 Server Apache Transfer-Encoding chunked
GET H/1.1	404 Not Found	main.css jawatankosong2023.my.id/23/ast/css/	0 0	253ms 252ms	Stylesheet text/html	103.250.10.246 CLOUDHOST-AS-AP C...
General Check archive.org Show headers Download Go to Full URL http://jawatankosong2023.my.id/23/ast/css/main.css Requested by Host: jawatankosong2023.my.id URL: http://jawatankosong2023.my.id/23/ Protocol HTTP/1.1 Server 103.250.10.246 , Indonesia, ASN138608 (CLOUDHOST-AS-AP Cloud Host Pte Ltd, SG), Reverse DNS rulzprivateserver.godd.my.id Software Apache / Resource Hash Request headers accept-language fi-FI,fi;q=0.9 Referer http://jawatankosong2023.my.id/23/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Date Tue, 22 Aug 2023 06:23:18 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H2	200	jquery-3.5.1.min.js Show response code.jquery.com/	87 KB 30 KB	149ms 49ms	Script application/javascript	2001:4de0:ac18::1:a:1a STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.5.1.min.js Requested by Host: jawatankosong2023.my.id URL: http://jawatankosong2023.my.id/23/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Request headers accept-language fi-FI,fi;q=0.9 Referer http://jawatankosong2023.my.id/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 22 Aug 2023 06:23:18 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-15d84" vary Accept-Encoding x-hw 1692685398.dop222.sk1.t,1692685398.cds240.sk1.hn,1692685398.cds208.sk1.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30879
GET H2	200	font-roboto.css telegram.org/css/	6 KB 894 B	229ms 72ms	Stylesheet text/css	2001:67c:4e8:f004::9 TELEGRAM
General Check archive.org Show headers Download Go to Full URL https://telegram.org/css/font-roboto.css?1 Requested by Host: jawatankosong2023.my.id URL: http://jawatankosong2023.my.id/23/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (TELEGRAM, VG), Reverse DNS Software nginx/1.18.0 / Resource Hash 84b97b3fa8847b64c6d3833561e4b3146530577171e85ad226578a087db70974 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language fi-FI,fi;q=0.9 Referer http://jawatankosong2023.my.id/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 22 Aug 2023 06:23:18 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip last-modified Thu, 20 Oct 2022 11:05:33 GMT server nginx/1.18.0 etag W/"63512b7d-1816" content-type text/css cache-control max-age=345600 expires Sat, 26 Aug 2023 06:23:18 GMT
GET H2	200	bootstrap.min.css telegram.org/css/	42 KB 10 KB	230ms 74ms	Stylesheet text/css	2001:67c:4e8:f004::9 TELEGRAM
General Check archive.org Show headers Download Go to Full URL https://telegram.org/css/bootstrap.min.css?3 Requested by Host: jawatankosong2023.my.id URL: http://jawatankosong2023.my.id/23/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (TELEGRAM, VG), Reverse DNS Software nginx/1.18.0 / Resource Hash f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language fi-FI,fi;q=0.9 Referer http://jawatankosong2023.my.id/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 22 Aug 2023 06:23:18 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip last-modified Fri, 10 Nov 2017 17:54:14 GMT server nginx/1.18.0 etag W/"5a05e7c6-a61b" content-type text/css cache-control max-age=345600 expires Sat, 26 Aug 2023 06:23:18 GMT
GET H2	200	telegram.css telegram.org/css/	112 KB 29 KB	302ms 146ms	Stylesheet text/css	2001:67c:4e8:f004::9 TELEGRAM
General Check archive.org Show headers Download Go to Full URL https://telegram.org/css/telegram.css?236 Requested by Host: jawatankosong2023.my.id URL: http://jawatankosong2023.my.id/23/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (TELEGRAM, VG), Reverse DNS Software nginx/1.18.0 / Resource Hash acd326a9263ee8c4cbc757fed46333732a0e3f8f48d398cbd4f8e36a09fdaf76 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language fi-FI,fi;q=0.9 Referer http://jawatankosong2023.my.id/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 22 Aug 2023 06:23:18 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip last-modified Mon, 20 Mar 2023 10:58:55 GMT server nginx/1.18.0 etag W/"64183c6f-1c0b3" content-type text/css cache-control max-age=345600 expires Sat, 26 Aug 2023 06:23:18 GMT
GET H2	200	469b1d66-05d1-4900-9835-091aecd1c34d.jpg i.ibb.co/k14sZ1s/	169 KB 170 KB	250ms 90ms	Image image/jpeg	162.19.58.159 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://i.ibb.co/k14sZ1s/469b1d66-05d1-4900-9835-091aecd1c34d.jpg Requested by Host: jawatankosong2023.my.id URL: http://jawatankosong2023.my.id/23/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.19.58.159 , France, ASN16276 (OVH, FR), Reverse DNS ns3096667.ip-162-19-58.eu Software nginx / Resource Hash 04d55f06339b9808241eb4322e3841918d6e353e0f0bc9cf107b783a9ac77f71 Request headers accept-language fi-FI,fi;q=0.9 Referer http://jawatankosong2023.my.id/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 22 Aug 2023 06:23:19 GMT last-modified Mon, 31 Jul 2023 04:28:39 GMT server nginx access-control-allow-methods GET, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 173269 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	tgwallpaper.min.js Show response telegram.org/js/	3 KB 2 KB	121ms 120ms	Script application/javascript	2001:67c:4e8:f004::9 TELEGRAM
General Check archive.org Show headers Download Go to Full URL https://telegram.org/js/tgwallpaper.min.js?3 Requested by Host: jawatankosong2023.my.id URL: http://jawatankosong2023.my.id/23/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (TELEGRAM, VG), Reverse DNS Software nginx/1.18.0 / Resource Hash 2031e418ee10af8110729b3f327b968462fc0a9d8d1da095387bb472ccd0dee6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language fi-FI,fi;q=0.9 Referer http://jawatankosong2023.my.id/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 22 Aug 2023 06:23:19 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip last-modified Thu, 03 Mar 2022 19:57:25 GMT server nginx/1.18.0 etag W/"62211da5-ba3" content-type application/javascript cache-control max-age=345600 expires Sat, 26 Aug 2023 06:23:19 GMT
GET H2	200	pattern.svg telegram.org/img/tgme/	226 KB 81 KB	75ms 75ms	Image image/svg+xml	2001:67c:4e8:f004::9 TELEGRAM
General Check archive.org Show headers Download Go to Show image Full URL https://telegram.org/img/tgme/pattern.svg?1 Requested by Host: telegram.org URL: https://telegram.org/css/telegram.css?236 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (TELEGRAM, VG), Reverse DNS Software nginx/1.18.0 / Resource Hash 118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4 Request headers accept-language fi-FI,fi;q=0.9 Referer https://telegram.org/css/telegram.css?236 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 22 Aug 2023 06:23:19 GMT content-encoding gzip last-modified Thu, 05 Jan 2023 17:52:04 GMT server nginx/1.18.0 etag W/"63b70e44-3891a" content-type image/svg+xml access-control-allow-origin * cache-control max-age=345600 expires Sat, 26 Aug 2023 06:23:19 GMT
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2 telegram.org/fonts/Roboto/	11 KB 11 KB	222ms 73ms	Font application/octet-stream	2001:67c:4e8:f004::9 TELEGRAM
General Check archive.org Show headers Download Go to Full URL https://telegram.org/fonts/Roboto/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2 Requested by Host: telegram.org URL: https://telegram.org/css/font-roboto.css?1 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (TELEGRAM, VG), Reverse DNS Software nginx/1.18.0 / Resource Hash 0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44 Request headers Referer https://telegram.org/css/font-roboto.css?1 Origin http://jawatankosong2023.my.id accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 22 Aug 2023 06:23:19 GMT last-modified Thu, 20 Oct 2022 11:05:33 GMT server nginx/1.18.0 etag "63512b7d-2b20" content-type application/octet-stream access-control-allow-origin * cache-control max-age=345600 accept-ranges bytes content-length 11040 expires Sat, 26 Aug 2023 06:23:19 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 telegram.org/fonts/Roboto/	11 KB 11 KB	294ms 145ms	Font application/octet-stream	2001:67c:4e8:f004::9 TELEGRAM
General Check archive.org Show headers Download Go to Full URL https://telegram.org/fonts/Roboto/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: telegram.org URL: https://telegram.org/css/font-roboto.css?1 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (TELEGRAM, VG), Reverse DNS Software nginx/1.18.0 / Resource Hash 796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f Request headers Referer https://telegram.org/css/font-roboto.css?1 Origin http://jawatankosong2023.my.id accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 22 Aug 2023 06:23:19 GMT last-modified Thu, 20 Oct 2022 11:05:33 GMT server nginx/1.18.0 etag "63512b7d-2b14" content-type application/octet-stream access-control-allow-origin * cache-control max-age=345600 accept-ranges bytes content-length 11028 expires Sat, 26 Aug 2023 06:23:19 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| TWallpaper string| protoUrl undefined| iframeContEl undefined| iframeEl undefined| pageHidden object| tme_bg function| toggleTheme object| darkMedia

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://jawatankosong2023.my.id/23/ast/css/main.css Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
i.ibb.co
jawatankosong2023.my.id
telegram.org
103.250.10.246
162.19.58.159
2001:4de0:ac18::1:a:1a
2001:67c:4e8:f004::9
04d55f06339b9808241eb4322e3841918d6e353e0f0bc9cf107b783a9ac77f71
0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44
118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4
2031e418ee10af8110729b3f327b968462fc0a9d8d1da095387bb472ccd0dee6
5eef5a20cab4db0ee6f8ec9a73f0029c3eb07aa54cae7266be60780bbe5e6bee
796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f
84b97b3fa8847b64c6d3833561e4b3146530577171e85ad226578a087db70974
acd326a9263ee8c4cbc757fed46333732a0e3f8f48d398cbd4f8e36a09fdaf76
f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d