fkip.unrika.ac.id - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 43.225.184.195, located in Indonesia and belongs to SOLNET-ID PT SOLNET INDONESIA, ID. The main domain is fkip.unrika.ac.id.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 14th 2020. Valid for: 3 months.

This is the only time fkip.unrika.ac.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	208.76.246.144 208.76.246.144	20202 (CRUCIAL) (CRUCIAL)
1 5	43.225.184.195 43.225.184.195	9422 (SOLNET-ID...) (SOLNET-ID PT SOLNET INDONESIA)
1	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	3

1 208.76.246.144 (Dallas, United States)

ASN20202 (CRUCIAL, US)
PTR: s484.c4.crucialp.com

www.jibarotech.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 43.225.184.195 (Indonesia) 1 redirects

ASN9422 (SOLNET-ID PT SOLNET INDONESIA, ID)
PTR: FAST-INTERNET-43-225-184-195.solnet.net.id

fkip.unrika.ac.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	unrika.ac.id 1 redirects fkip.unrika.ac.id	282 KB
1	cloudflare.com cdnjs.cloudflare.com	19 KB
1	jibarotech.com www.jibarotech.com	363 B
6	3

	Domain	Requested by
5	fkip.unrika.ac.id	1 redirects fkip.unrika.ac.id
1	cdnjs.cloudflare.com	fkip.unrika.ac.id
1	www.jibarotech.com
6	3

This site contains no links.

Subject Issuer	Validity	Valid
fkip.unrika.ac.id Let's Encrypt Authority X3	`2020-10-14` - `2021-01-12`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-10-21` - `2021-10-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://fkip.unrika.ac.id/data/
Frame ID: 71EDF2DBBFAD560F86F2B01B9DBC81B8
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.jibarotech.com/-/ Page URL
https://fkip.unrika.ac.id/data HTTP 301
https://fkip.unrika.ac.id/data/ Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

6
Requests

83 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

301 kB
Transfer

351 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.jibarotech.com/-/ Page URL
https://fkip.unrika.ac.id/data HTTP 301
https://fkip.unrika.ac.id/data/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
www.jibarotech.com/-/ 156 B
363 B 669ms
338ms Document
text/html 208.76.246.144
CRUCIAL

General

Check archive.org

Show headers Download Go to

Full URL: http://www.jibarotech.com/-/
Protocol: HTTP/1.1
Server: 208.76.246.144 Dallas, United States, ASN20202 (CRUCIAL, US),
Reverse DNS: s484.c4.crucialp.com
Software: Apache /
Resource Hash: 18951db0e21593e85f08ca5001efad94e2b66f2907a4ef42be0488fc36ce64e2

Request headers

Host: www.jibarotech.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 08 Nov 2020 13:27:16 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1

200
OK

Primary Request / Show response
fkip.unrika.ac.id/data/
Redirect Chain

https://fkip.unrika.ac.id/data
https://fkip.unrika.ac.id/data/

984 B
760 B

190ms
189ms

Document
text/html

43.225.184.195
SOLNET-ID PT SOLN...

General

Check archive.org

Show headers Download Go to

Full URL: https://fkip.unrika.ac.id/data/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 43.225.184.195 , Indonesia, ASN9422 (SOLNET-ID PT SOLNET INDONESIA, ID),
Reverse DNS: FAST-INTERNET-43-225-184-195.solnet.net.id
Software: nginx /
Resource Hash: 29937cb9db2394fb7ffc6fe9e2dd9ee4169d52ab42a6480380650734e73c0e3d

Request headers

Host: fkip.unrika.ac.id
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: http://www.jibarotech.com/-/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://www.jibarotech.com/-/

Response headers

Server: nginx
Date: Sun, 08 Nov 2020 13:27:17 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 533
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
Content-Encoding: gzip

Redirect headers

Server: nginx
Date: Sun, 08 Nov 2020 13:27:17 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 239
Connection: keep-alive
Keep-Alive: timeout=60
Location: https://fkip.unrika.ac.id/data/

GET
H2 200 mobile-detect.js Show response
cdnjs.cloudflare.com/ajax/libs/mobile-detect/1.4.3/ 67 KB
19 KB 12ms
12ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/mobile-detect/1.4.3/mobile-detect.js

Requested by

Host: fkip.unrika.ac.id
URL: https://fkip.unrika.ac.id/data/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a91c0c6e1abdac6c7a56cad366ef3e01dab8c36dc2d05ce9121a8ea34275e3b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000

Request headers

Referer: https://fkip.unrika.ac.id/data/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 08 Nov 2020 13:27:17 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 200516
x-via: cfworker/kv
status: 200
content-length: 18681
cf-request-id: 0649a339c2000005f9bc24d000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:13:25 GMT
server: cloudflare
etag: "5eb03f25-10cea"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=90iMrTPN6k4CSYASX3y0efib28VDhgZifjmeOTQ2fCHqtuRiLmjdUUOEUTIbyQJ4tgE7yS49d7IqkpS8Szy%2B4NR1hZ8ZxTQtgW4aoQ3ipRYVh1WWiWs3lI6cGumn8Hthvw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 5eefa16f9e9005f9-FRA
expires: Fri, 29 Oct 2021 13:27:17 GMT

GET
H/1.1 200
OK mslogo.jpg
fkip.unrika.ac.id/data/ 3 KB
3 KB 188ms
187ms Image
image/jpeg 43.225.184.195
SOLNET-ID PT SOLN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fkip.unrika.ac.id/data/mslogo.jpg
Requested by: Host: fkip.unrika.ac.id
URL: https://fkip.unrika.ac.id/data/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 43.225.184.195 , Indonesia, ASN9422 (SOLNET-ID PT SOLNET INDONESIA, ID),
Reverse DNS: FAST-INTERNET-43-225-184-195.solnet.net.id
Software: nginx /
Resource Hash: bc2b16b51738b77d94ed7591ad1033fa804297ca9faaa35222aa65773f749164

Request headers

Referer: https://fkip.unrika.ac.id/data/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 08 Nov 2020 13:27:17 GMT
Last-Modified: Mon, 12 Oct 2020 11:47:04 GMT
Server: nginx
ETag: "5f844238-aed"
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=60
Content-Length: 2797
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK pc.css
fkip.unrika.ac.id/data/css/ 3 KB
1 KB 188ms
188ms Stylesheet
text/css 43.225.184.195
SOLNET-ID PT SOLN...

General

Check archive.org

Show headers Download Go to

Full URL: https://fkip.unrika.ac.id/data/css/pc.css
Requested by: Host: fkip.unrika.ac.id
URL: https://fkip.unrika.ac.id/data/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 43.225.184.195 , Indonesia, ASN9422 (SOLNET-ID PT SOLNET INDONESIA, ID),
Reverse DNS: FAST-INTERNET-43-225-184-195.solnet.net.id
Software: nginx /
Resource Hash: 2f3fe74f82d4619f71d0c839d690ffe686ab5c0022eade68609c840e0dd82429

Request headers

Referer: https://fkip.unrika.ac.id/data/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 08 Nov 2020 13:27:17 GMT
Content-Encoding: gzip
Last-Modified: Mon, 12 Oct 2020 11:47:04 GMT
Server: nginx
ETag: W/"5f844238-b90"
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=315360000
Connection: keep-alive
Keep-Alive: timeout=60
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK img.jpg
fkip.unrika.ac.id/data/ 277 KB
277 KB 360ms
359ms Image
image/jpeg 43.225.184.195
SOLNET-ID PT SOLN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fkip.unrika.ac.id/data/img.jpg
Requested by: Host: fkip.unrika.ac.id
URL: https://fkip.unrika.ac.id/data/css/pc.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 43.225.184.195 , Indonesia, ASN9422 (SOLNET-ID PT SOLNET INDONESIA, ID),
Reverse DNS: FAST-INTERNET-43-225-184-195.solnet.net.id
Software: nginx /
Resource Hash: 211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb

Request headers

Referer: https://fkip.unrika.ac.id/data/css/pc.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 08 Nov 2020 13:27:18 GMT
Last-Modified: Mon, 12 Oct 2020 11:47:04 GMT
Server: nginx
ETag: "5f844238-452d7"
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=60
Content-Length: 283351
Expires: Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
fkip.unrika.ac.id
www.jibarotech.com
208.76.246.144
2606:4700::6810:125e
43.225.184.195
18951db0e21593e85f08ca5001efad94e2b66f2907a4ef42be0488fc36ce64e2
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
29937cb9db2394fb7ffc6fe9e2dd9ee4169d52ab42a6480380650734e73c0e3d
2f3fe74f82d4619f71d0c839d690ffe686ab5c0022eade68609c840e0dd82429
a91c0c6e1abdac6c7a56cad366ef3e01dab8c36dc2d05ce9121a8ea34275e3b0
bc2b16b51738b77d94ed7591ad1033fa804297ca9faaa35222aa65773f749164

fkip.unrika.ac.id Open in urlscan Pro 43.225.184.195 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

83 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

301 kBTransfer

351 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

Indicators

fkip.unrika.ac.id Open in urlscan Pro
43.225.184.195 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

83 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

301 kB
Transfer

351 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!