upt-dinkes.gresikkab.go.id Open in urlscan Pro
103.170.104.118 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.data.xss.dll.css.g.o.v.uk.1vesiliip6.eiarash.ir/.zqz/.zxz/?1VeSiliIp6
Effective URL:
https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securess...
Submission: On March 10 via manual (March 10th 2023, 11:08:07 am UTC) from GB — Scanned from GB

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 13 HTTP transactions. The main IP is 103.170.104.118, located in Indonesia and belongs to IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID. The main domain is upt-dinkes.gresikkab.go.id.
TLS certificate: Issued by AlphaSSL CA - SHA256 - G4 on December 8th 2022. Valid for: a year.

This is the only time upt-dinkes.gresikkab.go.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UK Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
1 1	185.83.208.90 185.83.208.90	42468 (MIZ) (MIZ)
1 14	103.170.104.118 103.170.104.118	132634 (IDNIC-EGO...) (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO)
13	2

1 185.83.208.90 (Iran, Islamic Republic Of) 1 redirects

ASN42468 (MIZ, IR)
PTR: ns25.mizban.com

www.data.xss.dll.css.g.o.v.uk.1vesiliip6.eiarash.ir	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 103.170.104.118 (Indonesia) 1 redirects

ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID)

upt-dinkes.gresikkab.go.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	gresikkab.go.id 1 redirects upt-dinkes.gresikkab.go.id	600 KB
1	eiarash.ir 1 redirects www.data.xss.dll.css.g.o.v.uk.1vesiliip6.eiarash.ir	339 B
13	2

	Domain	Requested by
14	upt-dinkes.gresikkab.go.id	1 redirects upt-dinkes.gresikkab.go.id
1	www.data.xss.dll.css.g.o.v.uk.1vesiliip6.eiarash.ir	1 redirects
13	2

This site contains no links.

Subject Issuer	Validity	Valid
*.gresikkab.go.id AlphaSSL CA - SHA256 - G4	`2022-12-08` - `2024-01-09`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true
Frame ID: 7E2ECA143BD68F059A952B740440D4E9
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Check if a vehicle is taxed and has an MOT

Page URL History Show full URLs

http://www.data.xss.dll.css.g.o.v.uk.1vesiliip6.eiarash.ir/.zqz/.zxz/?1VeSiliIp6 HTTP 302
https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/?sessionid=bcaa222fcfb7e06def307a2bc49a5aca&... HTTP 302
https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

GOV.UK Template (UI frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+govuk-template[^>"]+css
<link[^>]+govuk-template-print[^>"]+css
<link[^>]+govuk-template-ie6[^>"]+css
<link[^>]+govuk-template-ie7[^>"]+css
<link[^>]+govuk-template-ie8[^>"]+css

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

764 kB
Transfer

761 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.data.xss.dll.css.g.o.v.uk.1vesiliip6.eiarash.ir/.zqz/.zxz/?1VeSiliIp6 HTTP 302
https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/?sessionid=bcaa222fcfb7e06def307a2bc49a5aca&securessl=true HTTP 302
https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	404 Not Found	Primary Request vehicle.php Show response upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/ Redirect Chain http://www.data.xss.dll.css.g.o.v.uk.1vesiliip6.eiarash.ir/.zqz/.zxz/?1VeSiliIp6 https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/?sessionid=bcaa222fcfb7e06def307a2bc49a5aca&securessl=true https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true	8 KB 8 KB	745ms 745ms	Document text/html	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `334fab0168b5094969063b621fb43940e86b9d720d1c1099c917f697c50f958e` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers Connection Keep-Alive Content-Type text/html;charset=utf-8 Date Fri, 10 Mar 2023 11:07:58 GMT Keep-Alive timeout=5, max=99 Server Apache Transfer-Encoding chunked Redirect headers Connection Keep-Alive Content-Length 0 Content-Type text/html;charset=utf-8 Date Fri, 10 Mar 2023 11:07:56 GMT Keep-Alive timeout=5, max=100 Location vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true Server Apache
GET H/1.1	200 OK	govuk-template.css upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	21 KB 21 KB	859ms 858ms	Stylesheet text/css	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/govuk-template.css Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `474355689b2be8afaf8855ef7bed7d420a624fdc662622acc13486a3a10eb86f` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Fri, 10 Mar 2023 11:07:58 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 21085
GET H/1.1	200 OK	govuk-elements-styles.css upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	44 KB 44 KB	964ms 963ms	Stylesheet text/css	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/govuk-elements-styles.css Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `faeb217e3bd29a944537a1c20d2f2c0460a67d003481bdd6667522f33d999731` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Fri, 10 Mar 2023 11:07:58 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 44595
GET H/1.1	200 OK	fonts.css upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	267 KB 267 KB	1434ms 882ms	Stylesheet text/css	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/fonts.css Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `a528ccc945a82c9af4b09971cffe3c6ecb37d9b9dc446c8f53cadc81cb8cea43` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Fri, 10 Mar 2023 11:07:59 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 273330
GET H/1.1	200 OK	application.css upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	81 KB 81 KB	1447ms 882ms	Stylesheet text/css	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/application.css Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `95e6217d2b45e1a3c24a333cc9c33c45b9d8c99942a3870f7490bf459bfc646d` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Fri, 10 Mar 2023 11:07:59 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 83106
GET H/1.1	200 OK	numberplate.css upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	47 KB 48 KB	1473ms 893ms	Stylesheet text/css	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/numberplate.css Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `b43f9e92939bf468dd2dc0e9c7637c3b6b8f3b4c821c1c877dab6c7617a98be1` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Fri, 10 Mar 2023 11:07:59 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 48424
GET H/1.1	200 OK	jquery-1.11.3.min.js Show response upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	94 KB 94 KB	1515ms 933ms	Script application/javascript	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/jquery-1.11.3.min.js Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `20e11ce61890c08c0529911822233c9023ebc367df6c1050dec105e2b9628104` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Fri, 10 Mar 2023 11:07:59 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 95962
GET H/1.1	200 OK	jquery.validate.min.js Show response upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	23 KB 23 KB	1973ms 827ms	Script application/javascript	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/jquery.validate.min.js Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `c4ec8763c6f7c6b9efc4a180baadbc2a4eaf9317f2781c9a4705c8c56774993d` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Fri, 10 Mar 2023 11:07:59 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 23073
GET H/1.1	200 OK	jquery.validate.unobtrusive.min.js Show response upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	6 KB 6 KB	2383ms 864ms	Script application/javascript	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/jquery.validate.unobtrusive.min.js Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `eb297808949feda2a532a73e1f1095d8e35e2ee2d4941b73ae2977f5ae388d11` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Fri, 10 Mar 2023 11:08:00 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 6276
GET H/1.1	200 OK	gov.uk_logotype_crown.png upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	1 KB 2 KB	848ms 848ms	Image image/png	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Show image Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/gov.uk_logotype_crown.png Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `ea874a79e09423d63420aff44f016fd0b92dc6dec0cc2668d63b150c8669875e` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Fri, 10 Mar 2023 11:08:01 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1415
GET H/1.1	200 OK	govuk-template-print.css upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	2 KB 2 KB	858ms 857ms	Stylesheet text/css	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/govuk-template-print.css Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `efb298d2297d1e2eb2922e8b5bd964ba733c3e9657389204ed664be85fe3c40e` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Fri, 10 Mar 2023 11:08:01 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1690
GET H/1.1	200 OK	open-government-licence.png upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	761 B 1002 B	856ms 856ms	Image image/png	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Show image Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/open-government-licence.png Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/govuk-template.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `c1aedc8257961b938b4c7a21a2b0db3f2716dd9ef782cea73110dc69107c9042` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/govuk-template.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Fri, 10 Mar 2023 11:08:01 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 761
GET H/1.1	200 OK	govuk-crest.png upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/	4 KB 4 KB	832ms 832ms	Image image/png	103.170.104.118 IDNIC-EGOV-AS-ID ...
General Check archive.org Show headers Download Go to Show image Full URL https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/govuk-crest.png Requested by Host: upt-dinkes.gresikkab.go.id URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/govuk-template.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.170.104.118 , Indonesia, ASN132634 (IDNIC-EGOV-AS-ID Direktorat E-Goverment Kementerian KOMINFO, ID), Reverse DNS Software Apache / Resource Hash `bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b` Request headers accept-language en-GB,en;q=0.9 Referer https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle_files/govuk-template.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Fri, 10 Mar 2023 11:08:01 GMT Last-Modified Thu, 11 Aug 2022 09:26:17 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 3584
GET DATA	200 OK	truncated /	94 KB 94 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30` Request headers Referer Origin https://upt-dinkes.gresikkab.go.id accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	71 KB 71 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba` Request headers Referer Origin https://upt-dinkes.gresikkab.go.id accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type application/font-woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UK Government (Government)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://upt-dinkes.gresikkab.go.id/.well-known/.xzx/.zqz/qx/source/vehicle.php?&sessionid=7c68ef67ae5822ca06365db4c067e8f5&securessl=true Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

upt-dinkes.gresikkab.go.id
www.data.xss.dll.css.g.o.v.uk.1vesiliip6.eiarash.ir
103.170.104.118
185.83.208.90
01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba
048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30
20e11ce61890c08c0529911822233c9023ebc367df6c1050dec105e2b9628104
334fab0168b5094969063b621fb43940e86b9d720d1c1099c917f697c50f958e
474355689b2be8afaf8855ef7bed7d420a624fdc662622acc13486a3a10eb86f
95e6217d2b45e1a3c24a333cc9c33c45b9d8c99942a3870f7490bf459bfc646d
a528ccc945a82c9af4b09971cffe3c6ecb37d9b9dc446c8f53cadc81cb8cea43
b43f9e92939bf468dd2dc0e9c7637c3b6b8f3b4c821c1c877dab6c7617a98be1
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b
c1aedc8257961b938b4c7a21a2b0db3f2716dd9ef782cea73110dc69107c9042
c4ec8763c6f7c6b9efc4a180baadbc2a4eaf9317f2781c9a4705c8c56774993d
ea874a79e09423d63420aff44f016fd0b92dc6dec0cc2668d63b150c8669875e
eb297808949feda2a532a73e1f1095d8e35e2ee2d4941b73ae2977f5ae388d11
efb298d2297d1e2eb2922e8b5bd964ba733c3e9657389204ed664be85fe3c40e
faeb217e3bd29a944537a1c20d2f2c0460a67d003481bdd6667522f33d999731

upt-dinkes.gresikkab.go.id Open in urlscan Pro 103.170.104.118 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

764 kBTransfer

761 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

upt-dinkes.gresikkab.go.id Open in urlscan Pro
103.170.104.118 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

764 kB
Transfer

761 kB
Size

0
Cookies

13 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!