pkl.madiunkab.go.id - urlscan.io

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 6 HTTP transactions. The main IP is 103.132.230.21, located in Indonesia and belongs to IDNIC-PEMKAB-MADIUN-AS-ID PEMERINTAH KABUPATEN MADIUN, ID. The main domain is pkl.madiunkab.go.id.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 10th 2021. Valid for: 3 months.

This is the only time pkl.madiunkab.go.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	78.142.210.231 78.142.210.231	209853 (VERIDYEN ...) (VERIDYEN Veridyen Bilisim Teknolojileri Sanayi ve Ticaret Limited Sirketi)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2a	20446 (HIGHWINDS3) (HIGHWINDS3)
3	103.132.230.21 103.132.230.21	138127 (IDNIC-PEM...) (IDNIC-PEMKAB-MADIUN-AS-ID PEMERINTAH KABUPATEN MADIUN)
6	3

2 78.142.210.231 (Turkey)

ASN209853 (VERIDYEN Veridyen Bilisim Teknolojileri Sanayi ve Ticaret Limited Sirketi, TR)
PTR: erva.veridyen.com

iqj.n4h.aracatibutikotel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 103.132.230.21 (Indonesia)

ASN138127 (IDNIC-PEMKAB-MADIUN-AS-ID PEMERINTAH KABUPATEN MADIUN, ID)
PTR: djoemeno.madiunkab.go.id

pkl.madiunkab.go.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	madiunkab.go.id pkl.madiunkab.go.id	78 KB
2	aracatibutikotel.com iqj.n4h.aracatibutikotel.com	1013 B
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 546	83 KB
6	3

	Domain	Requested by
3	pkl.madiunkab.go.id	iqj.n4h.aracatibutikotel.com pkl.madiunkab.go.id
2	iqj.n4h.aracatibutikotel.com	code.jquery.com
1	code.jquery.com	iqj.n4h.aracatibutikotel.com
6	3

This site contains no links.

Subject Issuer	Validity	Valid
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
pkl.madiunkab.go.id cPanel, Inc. Certification Authority	`2021-12-10` - `2022-03-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://pkl.madiunkab.go.id/ciss/portal2/IK/of16%14%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%E4%99%95%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%D1%95%EF%BF%BD%D5%95%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD
Frame ID: 3092A2FB1C7D53EFBC12875A92128881
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Purchase Order.xlsx

Page URL History Show full URLs

http://iqj.n4h.aracatibutikotel.com/.56f_u2/15/2022%2010:37:56%20AMfir5610:37%20AM%20(%5B222ail_15o2ai37Par10:37... Page URL
https://pkl.madiunkab.go.id/ciss/portal2/IK/of16%14%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%B... Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

67 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

162 kB
Transfer

360 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://iqj.n4h.aracatibutikotel.com/.56f_u2/15/2022%2010:37:56%20AMfir5610:37%20AM%20(%5B222ail_15o2ai37Par10:37%20AM%5D)___56f_u2/15/2022%2010:37:56%20AMfir5610:37%20AM%20(%5B222ail_Lo2/15/2022%2010:37:56%20AMalPar10:37%20AM%5D) Page URL
https://pkl.madiunkab.go.id/ciss/portal2/IK/of16%14%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%E4%99%95%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%D1%95%EF%BF%BD%D5%95%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	2022%2010:37:56%20AMalPar10:37%20AM%5D) Show response iqj.n4h.aracatibutikotel.com/.56f_u2/15/2022%2010:37:56%20AMfir5610:37%20AM%20(%5B222ail_15o2ai37Par10:37%20AM%5D)___56f_u2/15/2022%2010:37:56%20AMfir5610:37%20AM%20(%5B222ail_Lo2/15/	934 B 731 B	487ms 81ms	Document text/html	78.142.210.231 VERIDYEN Veridyen...
General Check archive.org Show headers Download Go to Full URL http://iqj.n4h.aracatibutikotel.com/.56f_u2/15/2022%2010:37:56%20AMfir5610:37%20AM%20(%5B222ail_15o2ai37Par10:37%20AM%5D)___56f_u2/15/2022%2010:37:56%20AMfir5610:37%20AM%20(%5B222ail_Lo2/15/2022%2010:37:56%20AMalPar10:37%20AM%5D) Protocol HTTP/1.1 Server 78.142.210.231 , Turkey, ASN209853 (VERIDYEN Veridyen Bilisim Teknolojileri Sanayi ve Ticaret Limited Sirketi, TR), Reverse DNS erva.veridyen.com Software / Resource Hash `e0ac438c6a78f8c04e6a9d3e5e5bdad408de8392bb6db7e1c2471ef20014f498` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Content-Length 543 Content-Encoding gzip Vary Accept-Encoding Date Tue, 15 Feb 2022 19:52:02 GMT
GET H2	200	jquery-3.5.1.js Show response code.jquery.com/	281 KB 83 KB	61ms 19ms	Script application/javascript	2001:4de0:ac18::1:a:2a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.5.1.js Requested by Host: iqj.n4h.aracatibutikotel.com URL: http://iqj.n4h.aracatibutikotel.com/.56f_u2/15/2022%2010:37:56%20AMfir5610:37%20AM%20(%5B222ail_15o2ai37Par10:37%20AM%5D)___56f_u2/15/2022%2010:37:56%20AMfir5610:37%20AM%20(%5B222ail_Lo2/15/2022%2010:37:56%20AMalPar10:37%20AM%5D) Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash `416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37` Request headers Referer http://iqj.n4h.aracatibutikotel.com/ Origin http://iqj.n4h.aracatibutikotel.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Tue, 15 Feb 2022 19:52:03 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-4638e" vary Accept-Encoding x-hw 1644954723.dop149.fr8.t,1644954723.cds211.fr8.hn,1644954723.cds254.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 84374
POST H/1.1	200 OK	api.php iqj.n4h.aracatibutikotel.com/wild/	72 B 282 B	76ms 76ms	XHR text/html	78.142.210.231 VERIDYEN Veridyen...
General Check archive.org Show headers Download Go to Full URL http://iqj.n4h.aracatibutikotel.com/wild/api.php Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.5.1.js Protocol HTTP/1.1 Server 78.142.210.231 , Turkey, ASN209853 (VERIDYEN Veridyen Bilisim Teknolojileri Sanayi ve Ticaret Limited Sirketi, TR), Reverse DNS erva.veridyen.com Software / Resource Hash Request headers Accept / Referer http://iqj.n4h.aracatibutikotel.com/.56f_u2/15/2022%2010:37:56%20AMfir5610:37%20AM%20(%5B222ail_15o2ai37Par10:37%20AM%5D)___56f_u2/15/2022%2010:37:56%20AMfir5610:37%20AM%20(%5B222ail_Lo2/15/2022%2010:37:56%20AMalPar10:37%20AM%5D) X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Date Tue, 15 Feb 2022 19:52:02 GMT Content-Encoding gzip Connection Keep-Alive Content-Length 95 Vary Accept-Encoding Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	Primary Request of16%14%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%E4%99%95%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%D1%95%EF%BF%BD%D5%95%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD Show response pkl.madiunkab.go.id/ciss/portal2/IK/	979 B 1 KB	1996ms 1618ms	Document text/html	103.132.230.21 IDNIC-PEMKAB-MADI...
General Check archive.org Show headers Download Go to Full URL https://pkl.madiunkab.go.id/ciss/portal2/IK/of16%14%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%E4%99%95%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%D1%95%EF%BF%BD%D5%95%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD Requested by Host: iqj.n4h.aracatibutikotel.com URL: http://iqj.n4h.aracatibutikotel.com/.56f_u2/15/2022%2010:37:56%20AMfir5610:37%20AM%20(%5B222ail_15o2ai37Par10:37%20AM%5D)___56f_u2/15/2022%2010:37:56%20AMfir5610:37%20AM%20(%5B222ail_Lo2/15/2022%2010:37:56%20AMalPar10:37%20AM%5D) Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.132.230.21 , Indonesia, ASN138127 (IDNIC-PEMKAB-MADIUN-AS-ID PEMERINTAH KABUPATEN MADIUN, ID), Reverse DNS djoemeno.madiunkab.go.id Software Apache / Resource Hash `1136c9a45ab2405d21b3a4cd6d716333db1e7b68e5d6a7b53db89426ba38ae38` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer http://iqj.n4h.aracatibutikotel.com/ Response headers Date Tue, 15 Feb 2022 19:52:03 GMT Server Apache Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	loading.gif pkl.madiunkab.go.id/ciss/portal2/IK/	4 KB 4 KB	213ms 213ms	Image image/gif	103.132.230.21 IDNIC-PEMKAB-MADI...
General Check archive.org Show headers Download Go to Show image Full URL https://pkl.madiunkab.go.id/ciss/portal2/IK/loading.gif Requested by Host: pkl.madiunkab.go.id URL: https://pkl.madiunkab.go.id/ciss/portal2/IK/of16%14%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%E4%99%95%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%D1%95%EF%BF%BD%D5%95%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.132.230.21 , Indonesia, ASN138127 (IDNIC-PEMKAB-MADIUN-AS-ID PEMERINTAH KABUPATEN MADIUN, ID), Reverse DNS djoemeno.madiunkab.go.id Software Apache / Resource Hash `523c7a09818c209425f94502d83c5dc3b162b720ae8a1e7a21c852927d31ea19` Request headers Accept-Language de-DE,de;q=0.9 Referer https://pkl.madiunkab.go.id/ciss/portal2/IK/of16%14%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%E4%99%95%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%D1%95%EF%BF%BD%D5%95%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Date Tue, 15 Feb 2022 19:52:05 GMT Last-Modified Thu, 29 Apr 2021 02:23:02 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 3717
GET H/1.1	200 OK	xls.png pkl.madiunkab.go.id/ciss/portal2/IK/	73 KB 73 KB	427ms 213ms	Image image/png	103.132.230.21 IDNIC-PEMKAB-MADI...
General Check archive.org Show headers Download Go to Show image Full URL https://pkl.madiunkab.go.id/ciss/portal2/IK/xls.png Requested by Host: pkl.madiunkab.go.id URL: https://pkl.madiunkab.go.id/ciss/portal2/IK/of16%14%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%E4%99%95%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%D1%95%EF%BF%BD%D5%95%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.132.230.21 , Indonesia, ASN138127 (IDNIC-PEMKAB-MADIUN-AS-ID PEMERINTAH KABUPATEN MADIUN, ID), Reverse DNS djoemeno.madiunkab.go.id Software Apache / Resource Hash `bfb7362b6a5d508578ebe4f1884a92dba530b76fbe6be8db4a7b771c6aacaccf` Request headers Accept-Language de-DE,de;q=0.9 Referer https://pkl.madiunkab.go.id/ciss/portal2/IK/of16%14%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%E4%99%95%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%D1%95%EF%BF%BD%D5%95%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Date Tue, 15 Feb 2022 19:52:05 GMT Last-Modified Thu, 29 Apr 2021 02:23:02 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 74994

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
iqj.n4h.aracatibutikotel.com
pkl.madiunkab.go.id
103.132.230.21
2001:4de0:ac18::1:a:2a
78.142.210.231
1136c9a45ab2405d21b3a4cd6d716333db1e7b68e5d6a7b53db89426ba38ae38
416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37
523c7a09818c209425f94502d83c5dc3b162b720ae8a1e7a21c852927d31ea19
bfb7362b6a5d508578ebe4f1884a92dba530b76fbe6be8db4a7b771c6aacaccf
e0ac438c6a78f8c04e6a9d3e5e5bdad408de8392bb6db7e1c2471ef20014f498

pkl.madiunkab.go.id Open in urlscan Pro 103.132.230.21 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

67 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

162 kBTransfer

360 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

pkl.madiunkab.go.id Open in urlscan Pro
103.132.230.21 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

67 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

162 kB
Transfer

360 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!