zap.web.id Open in urlscan Pro
45.64.1.92 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://kientrucsaigon.net/downloading/aGFtb3V6b25Abm92YW50aGVhbHRoLm9yZw==
Effective URL:
https://zap.web.id/wp-content/authorize/c0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af5...
Submission: On June 24 via manual (June 24th 2019, 1:38:47 pm UTC) from US

Summary HTTP 8 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 45.64.1.92, located in Indonesia and belongs to MWN-AS-ID PT Master Web Network, ID. The main domain is zap.web.id.
TLS certificate: Issued by Let's Encrypt Authority X3 on May 15th 2019. Valid for: 3 months.

This is the only time zap.web.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
1 1	112.213.89.162 112.213.89.162		45544 (SUPERDATA...) (SUPERDATA-AS-VN SUPERDATA-)
1 9	45.64.1.92 45.64.1.92		55660 (MWN-AS-ID...) (MWN-AS-ID PT Master Web Network)
8	1

1 112.213.89.162 (Viet Nam) 1 redirects

ASN45544 (SUPERDATA-AS-VN SUPERDATA-, VN)
PTR: ns89162.dotvndns.vn

kientrucsaigon.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 45.64.1.92 (Indonesia) 1 redirects

ASN55660 (MWN-AS-ID PT Master Web Network, ID)
PTR: cl46098x.c.maintenis.com

zap.web.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	zap.web.id 1 redirects zap.web.id	312 KB
1	kientrucsaigon.net 1 redirects kientrucsaigon.net	149 B
8	2

	Domain	Requested by
9	zap.web.id	1 redirects zap.web.id
1	kientrucsaigon.net	1 redirects
8	2

This site contains no links.

Subject Issuer	Validity	Valid
zap.web.id Let's Encrypt Authority X3	`2019-05-15` - `2019-08-13`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://zap.web.id/wp-content/authorize/c0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6c
Frame ID: 49775977ABEA3E667D871C84BE9535D1
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://kientrucsaigon.net/downloading/aGFtb3V6b25Abm92YW50aGVhbHRoLm9yZw== HTTP 302
https://zap.web.id/wp-content/authorize/b//aGFtb3V6b25Abm92YW50aGVhbHRoLm9yZw== HTTP 307
https://zap.web.id/wp-content/authorize/c0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

311 kB
Transfer

376 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://kientrucsaigon.net/downloading/aGFtb3V6b25Abm92YW50aGVhbHRoLm9yZw== HTTP 302
https://zap.web.id/wp-content/authorize/b//aGFtb3V6b25Abm92YW50aGVhbHRoLm9yZw== HTTP 307
https://zap.web.id/wp-content/authorize/c0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6c Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request c0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6c Show response zap.web.id/wp-content/authorize/ Redirect Chain https://kientrucsaigon.net/downloading/aGFtb3V6b25Abm92YW50aGVhbHRoLm9yZw== https://zap.web.id/wp-content/authorize/b//aGFtb3V6b25Abm92YW50aGVhbHRoLm9yZw== https://zap.web.id/wp-content/authorize/c0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6c	4 KB 3 KB	2468ms 2467ms	Document text/html	45.64.1.92 MWN-AS-ID PT Mast...
General Check archive.org Show headers Download Go to Full URL https://zap.web.id/wp-content/authorize/c0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6c Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 45.64.1.92 , Indonesia, ASN55660 (MWN-AS-ID PT Master Web Network, ID), Reverse DNS cl46098x.c.maintenis.com Software Apache / Resource Hash `1f7ada85262ae7ab4ebcf1c2197e9acea0faa3149da3350de977ad4c2245dc9d` Request headers Host zap.web.id Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate, br Cookie ci_session=o0an4a7iop1j49juf1pn4bgdkn2otmg7 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 24 Jun 2019 13:38:23 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Vary Accept-Encoding Content-Encoding gzip Content-Length 2765 Keep-Alive timeout=5, max=99 Connection Keep-Alive Content-Type text/html; charset=UTF-8 Redirect headers Date Mon, 24 Jun 2019 13:38:20 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Set-Cookie ci_session=o0an4a7iop1j49juf1pn4bgdkn2otmg7; expires=Mon, 24-Jun-2019 15:38:22 GMT; Max-Age=7200; path=/; HttpOnly Location https://zap.web.id/wp-content/authorize/c0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6c Content-Length 0 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	jquery.min.js Show response zap.web.id/wp-content/authorize/assets/js/	85 KB 30 KB	1613ms 930ms	Script application/javascript	45.64.1.92 MWN-AS-ID PT Mast...
General Check archive.org Show headers Download Go to Full URL https://zap.web.id/wp-content/authorize/assets/js/jquery.min.js Requested by Host: zap.web.id URL: https://zap.web.id/wp-content/authorize/c0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6c Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 45.64.1.92 , Indonesia, ASN55660 (MWN-AS-ID PT Master Web Network, ID), Reverse DNS cl46098x.c.maintenis.com Software Apache / Resource Hash `160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef` Request headers Referer https://zap.web.id/wp-content/authorize/c0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6c User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 24 Jun 2019 13:38:27 GMT Content-Encoding gzip Last-Modified Sat, 22 Jun 2019 15:06:11 GMT Server Apache Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 30307
GET H/1.1	200 OK	script.js Show response zap.web.id/wp-content/authorize/assets/js/	3 KB 1 KB	1566ms 883ms	Script application/javascript	45.64.1.92 MWN-AS-ID PT Mast...
General Check archive.org Show headers Download Go to Full URL https://zap.web.id/wp-content/authorize/assets/js/script.js Requested by Host: zap.web.id URL: https://zap.web.id/wp-content/authorize/c0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6c Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 45.64.1.92 , Indonesia, ASN55660 (MWN-AS-ID PT Master Web Network, ID), Reverse DNS cl46098x.c.maintenis.com Software Apache / Resource Hash `13c9f6a51025521c4e2f6ddf976deb619f7475626f4268753157f637c4ce836b` Request headers Referer https://zap.web.id/wp-content/authorize/c0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6c User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 24 Jun 2019 13:38:27 GMT Content-Encoding gzip Last-Modified Sat, 22 Jun 2019 15:06:11 GMT Server Apache Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1065
GET H/1.1	200 OK	style.css zap.web.id/wp-content/authorize/assets/css/	3 KB 2 KB	1556ms 874ms	Stylesheet text/css	45.64.1.92 MWN-AS-ID PT Mast...
General Check archive.org Show headers Download Go to Full URL https://zap.web.id/wp-content/authorize/assets/css/style.css Requested by Host: zap.web.id URL: https://zap.web.id/wp-content/authorize/c0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6c Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 45.64.1.92 , Indonesia, ASN55660 (MWN-AS-ID PT Master Web Network, ID), Reverse DNS cl46098x.c.maintenis.com Software Apache / Resource Hash `5b53e9630576b25d6f149714136f8f5e93f9fc3a45d7bc1775710c0e59d84f61` Request headers Referer https://zap.web.id/wp-content/authorize/c0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6c User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 24 Jun 2019 13:38:27 GMT Content-Encoding gzip Last-Modified Sat, 22 Jun 2019 15:06:11 GMT Server Apache Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1248
GET H/1.1	200 OK	logo.svg zap.web.id/wp-content/authorize/assets/img/	4 KB 2 KB	1534ms 851ms	Image image/svg+xml	45.64.1.92 MWN-AS-ID PT Mast...
General Check archive.org Show headers Download Go to Show image Full URL https://zap.web.id/wp-content/authorize/assets/img/logo.svg Requested by Host: zap.web.id URL: https://zap.web.id/wp-content/authorize/c0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6c Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 45.64.1.92 , Indonesia, ASN55660 (MWN-AS-ID PT Master Web Network, ID), Reverse DNS cl46098x.c.maintenis.com Software Apache / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers Referer https://zap.web.id/wp-content/authorize/c0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6c User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 24 Jun 2019 13:38:27 GMT Content-Encoding gzip Last-Modified Sat, 22 Jun 2019 15:06:11 GMT Server Apache Vary Accept-Encoding Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1435
GET H/1.1	200 OK	acc.svg zap.web.id/wp-content/authorize/assets/img/	756 B 687 B	1593ms 911ms	Image image/svg+xml	45.64.1.92 MWN-AS-ID PT Mast...
General Check archive.org Show headers Download Go to Show image Full URL https://zap.web.id/wp-content/authorize/assets/img/acc.svg Requested by Host: zap.web.id URL: https://zap.web.id/wp-content/authorize/c0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6c Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 45.64.1.92 , Indonesia, ASN55660 (MWN-AS-ID PT Master Web Network, ID), Reverse DNS cl46098x.c.maintenis.com Software Apache / Resource Hash `5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69` Request headers Referer https://zap.web.id/wp-content/authorize/c0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6c User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 24 Jun 2019 13:38:27 GMT Content-Encoding gzip Last-Modified Sat, 22 Jun 2019 15:06:11 GMT Server Apache Vary Accept-Encoding Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 394
GET H/1.1	200 OK	bg.jpg zap.web.id/wp-content/authorize/assets/img/	277 KB 273 KB	821ms 821ms	Image image/jpeg	45.64.1.92 MWN-AS-ID PT Mast...
General Check archive.org Show headers Download Go to Show image Full URL https://zap.web.id/wp-content/authorize/assets/img/bg.jpg Requested by Host: zap.web.id URL: https://zap.web.id/wp-content/authorize/c0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6c Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 45.64.1.92 , Indonesia, ASN55660 (MWN-AS-ID PT Master Web Network, ID), Reverse DNS cl46098x.c.maintenis.com Software Apache / Resource Hash `211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb` Request headers Referer https://zap.web.id/wp-content/authorize/assets/css/style.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 24 Jun 2019 13:38:28 GMT Content-Encoding gzip Last-Modified Sat, 22 Jun 2019 15:06:11 GMT Server Apache Vary Accept-Encoding Content-Type image/jpeg Transfer-Encoding chunked Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99
GET H/1.1	200 OK	aGFtb3V6b25Abm92YW50aGVhbHRoLm9yZw== Show response zap.web.id/wp-content/authorize/login/domain/	4 B 455 B	2629ms 2629ms	XHR text/html	45.64.1.92 MWN-AS-ID PT Mast...
General Check archive.org Show headers Download Go to Full URL https://zap.web.id/wp-content/authorize/login/domain/aGFtb3V6b25Abm92YW50aGVhbHRoLm9yZw== Requested by Host: zap.web.id URL: https://zap.web.id/wp-content/authorize/assets/js/jquery.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 45.64.1.92 , Indonesia, ASN55660 (MWN-AS-ID PT Master Web Network, ID), Reverse DNS cl46098x.c.maintenis.com Software Apache / Resource Hash `b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b` Request headers Accept / Referer https://zap.web.id/wp-content/authorize/c0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6cc0bada67af57fe3335606a1a7e2f9f6c X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Mon, 24 Jun 2019 13:38:28 GMT Server Apache Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 4 Expires Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| _b5b4c5609bd316eb6 object| _k6a87752537c08791 function| xCRYPT function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://zap.web.id/wp-content/authorize/assets/js/script.js(Line 46) Message: true

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

kientrucsaigon.net
zap.web.id
112.213.89.162
45.64.1.92
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
13c9f6a51025521c4e2f6ddf976deb619f7475626f4268753157f637c4ce836b
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1f7ada85262ae7ab4ebcf1c2197e9acea0faa3149da3350de977ad4c2245dc9d
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
5b53e9630576b25d6f149714136f8f5e93f9fc3a45d7bc1775710c0e59d84f61
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b