tiki-indramayu.com Open in urlscan Pro
103.14.44.28 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://tiki-indramayu.com/ofc1
Effective URL:
https://tiki-indramayu.com/ofc1/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=bf208ce90f24d003819743247d0d3158210d6ac880c...
Submission: On August 13 via manual (August 13th 2020, 3:17:35 am UTC) from IN

Summary HTTP 4 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 4 HTTP transactions. The main IP is 103.14.44.28, located in Jakarta, Indonesia and belongs to MLD-ID PT MEDIA LINTAS DATA, ID. The main domain is tiki-indramayu.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 22nd 2020. Valid for: 3 months.

This is the only time tiki-indramayu.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2 4	103.14.44.28 103.14.44.28	45312 (MLD-ID PT...) (MLD-ID PT MEDIA LINTAS DATA)
1	2606:4700::68... 2606:4700::6811:4e6b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:3c01::f0... 2600:3c01::f03c:91ff:fe79:43b	63949 (LINODE-AP...) (LINODE-AP Linode)
4	4

4 103.14.44.28 (Jakarta, Indonesia) 2 redirects

ASN45312 (MLD-ID PT MEDIA LINTAS DATA, ID)
PTR: server1.rumahbagus.com

tiki-indramayu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:4e6b (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:3c01::f03c:91ff:fe79:43b (United States)

ASN63949 (LINODE-AP Linode, LLC, US)

jsonip.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	tiki-indramayu.com 2 redirects tiki-indramayu.com	362 KB
1	jsonip.com jsonip.com	453 B
1	cloudflare.com cdnjs.cloudflare.com	73 KB
4	3

	Domain	Requested by
4	tiki-indramayu.com	2 redirects
1	jsonip.com	cdnjs.cloudflare.com
1	cdnjs.cloudflare.com	tiki-indramayu.com
4	3

This site contains no links.

Subject Issuer	Validity	Valid
tiki-indramayu.com cPanel, Inc. Certification Authority	`2020-07-22` - `2020-10-20`	3 months	crt.sh
cdnjs.cloudflare.com DigiCert ECC Secure Server CA	`2020-08-12` - `2022-08-17`	2 years	crt.sh
jsonip.com Let's Encrypt Authority X3	`2020-06-28` - `2020-09-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://tiki-indramayu.com/ofc1/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=bf208ce90f24d003819743247d0d3158210d6ac880ccb02204558bcee265cb0d913c78dd
Frame ID: 95EA349E822E5B197A4BA005C7074CD2
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://tiki-indramayu.com/ofc1 HTTP 301
https://tiki-indramayu.com/ofc1/ HTTP 303
https://tiki-indramayu.com/ofc1/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=bf208ce90f24d0038197... Page URL
https://tiki-indramayu.com/ofc1/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=bf208ce90f24d0038197432... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

4
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

434 kB
Transfer

1203 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://tiki-indramayu.com/ofc1 HTTP 301
https://tiki-indramayu.com/ofc1/ HTTP 303
https://tiki-indramayu.com/ofc1/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=bf208ce90f24d003819743247d0d3158210d6ac880ccb02204558bcee265cb0d913c78dd Page URL
https://tiki-indramayu.com/ofc1/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=bf208ce90f24d003819743247d0d3158210d6ac880ccb02204558bcee265cb0d913c78dd Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://tiki-indramayu.com/ofc1 HTTP 301
https://tiki-indramayu.com/ofc1/ HTTP 303
https://tiki-indramayu.com/ofc1/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=bf208ce90f24d003819743247d0d3158210d6ac880ccb02204558bcee265cb0d913c78dd

4 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

r.php Show response
tiki-indramayu.com/ofc1/
Redirect Chain

https://tiki-indramayu.com/ofc1
https://tiki-indramayu.com/ofc1/
https://tiki-indramayu.com/ofc1/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=bf208ce90f24d003819743247d0d3158210d6ac880ccb02204558bcee265cb0d913c78dd

222 B
596 B

210ms
209ms

Document
text/html

103.14.44.28
MLD-ID PT MEDIA L...

General

Check archive.org

Show headers Download Go to

Full URL: https://tiki-indramayu.com/ofc1/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=bf208ce90f24d003819743247d0d3158210d6ac880ccb02204558bcee265cb0d913c78dd
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.14.44.28 Jakarta, Indonesia, ASN45312 (MLD-ID PT MEDIA LINTAS DATA, ID),
Reverse DNS: server1.rumahbagus.com
Software: Apache / PHP/7.2.32
Resource Hash: aeae16efa44d1ed3f239770be094dd14512dce37192d213d35462bc5a127f433

Request headers

Host: tiki-indramayu.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: PHPSESSID=deecf4782639ea9f0fa1b4d3b64e2bbe
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 13 Aug 2020 03:17:43 GMT
Server: Apache
X-Powered-By: PHP/7.2.32
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Encoding: gzip
Vary: Accept-Encoding
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Thu, 13 Aug 2020 03:17:43 GMT
Server: Apache
X-Powered-By: PHP/7.2.32
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Encoding: gzip
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=deecf4782639ea9f0fa1b4d3b64e2bbe; path=/
LOCATION: ./r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=bf208ce90f24d003819743247d0d3158210d6ac880ccb02204558bcee265cb0d913c78dd
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Primary Request / Show response
tiki-indramayu.com/ofc1/s/ 542 KB
360 KB 242ms
242ms Document
text/html 103.14.44.28
MLD-ID PT MEDIA L...

General

Check archive.org

Show headers Download Go to

Full URL: https://tiki-indramayu.com/ofc1/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=bf208ce90f24d003819743247d0d3158210d6ac880ccb02204558bcee265cb0d913c78dd
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.14.44.28 Jakarta, Indonesia, ASN45312 (MLD-ID PT MEDIA LINTAS DATA, ID),
Reverse DNS: server1.rumahbagus.com
Software: Apache / PHP/7.2.32
Resource Hash: 5c24a583c5f21f77ee0535703eb4254d0caddcb695ba2fae3a45a14d7e77051d

Request headers

Host: tiki-indramayu.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://tiki-indramayu.com/ofc1/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=bf208ce90f24d003819743247d0d3158210d6ac880ccb02204558bcee265cb0d913c78dd
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: PHPSESSID=deecf4782639ea9f0fa1b4d3b64e2bbe
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://tiki-indramayu.com/ofc1/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=bf208ce90f24d003819743247d0d3158210d6ac880ccb02204558bcee265cb0d913c78dd

Response headers

Date: Thu, 13 Aug 2020 03:17:43 GMT
Server: Apache
X-Powered-By: PHP/7.2.32
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Encoding: gzip
Vary: Accept-Encoding
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 jquery.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/ 257 KB
73 KB 27ms
26ms Script
application/javascript 2606:4700::6811:4e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/jquery.js

Requested by

Host: tiki-indramayu.com
URL: https://tiki-indramayu.com/ofc1/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=bf208ce90f24d003819743247d0d3158210d6ac880ccb02204558bcee265cb0d913c78dd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4e6b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8eb3cb67ef2f0f1b76167135cef6570a409c79b23f0bc0ede71c9a4018f1408a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://tiki-indramayu.com/ofc1/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=bf208ce90f24d003819743247d0d3158210d6ac880ccb02204558bcee265cb0d913c78dd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 13 Aug 2020 03:17:16 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 2263025
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 04876b76a00000d6b1f887c200000001
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:20:15 GMT
server: cloudflare
etag: W/"5afd494f-40464"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Tue, 03 Aug 2021 03:17:16 GMT
cache-control: public, max-age=30672000
cf-ray: 5c1f48376f50d6b1-FRA
served-in-seconds: 0.004

GET
DATA 200
OK truncated
/ 383 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 03b63adb7d36d516c81c636d57c6833f5c4618b51ef8eca813defd32077fbb2b

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK / Show response
jsonip.com/ 152 B
453 B 499ms
166ms Script
application/json 2600:3c01::f03c:91ff:fe79:43b
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL

https://jsonip.com/?callback=jQuery30008036350495373181_1597288636115&_=1597288636116

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/jquery.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:3c01::f03c:91ff:fe79:43b , United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx/1.16.1 /

Resource Hash

f43fc56ffea20b82b2b867af7a1c55cca71ff0faea35ca2b16a0beca3ec5bb38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

Referer: https://tiki-indramayu.com/ofc1/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=bf208ce90f24d003819743247d0d3158210d6ac880ccb02204558bcee265cb0d913c78dd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 13 Aug 2020 03:17:16 GMT
Server: nginx/1.16.1
Strict-Transport-Security: max-age=31536000;
Access-Control-Allow-Methods: GET
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: keep-alive

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 607cb3f1168955290148d6e4d7f91a2562eeafd9e6e042cb1a469090250a589e

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 10 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d5294df71bd09bf94dcc0cae591e69f4d6d1d176d8bd9973ca9011c01475ad64

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3be3ebc0fbc51164ddf3d17078feac8684d9c9550238346da061ee53e013fbfd

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| getIPAddress string| x

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			tiki-indramayu.com/ofc1/s	1969-12-31 23:59:59	Name: ip11 Value: 2a01:4f8:192:5414::2

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
jsonip.com
tiki-indramayu.com
103.14.44.28
2600:3c01::f03c:91ff:fe79:43b
2606:4700::6811:4e6b
03b63adb7d36d516c81c636d57c6833f5c4618b51ef8eca813defd32077fbb2b
3be3ebc0fbc51164ddf3d17078feac8684d9c9550238346da061ee53e013fbfd
5c24a583c5f21f77ee0535703eb4254d0caddcb695ba2fae3a45a14d7e77051d
607cb3f1168955290148d6e4d7f91a2562eeafd9e6e042cb1a469090250a589e
8eb3cb67ef2f0f1b76167135cef6570a409c79b23f0bc0ede71c9a4018f1408a
aeae16efa44d1ed3f239770be094dd14512dce37192d213d35462bc5a127f433
d5294df71bd09bf94dcc0cae591e69f4d6d1d176d8bd9973ca9011c01475ad64
f43fc56ffea20b82b2b867af7a1c55cca71ff0faea35ca2b16a0beca3ec5bb38

tiki-indramayu.com Open in urlscan Pro 103.14.44.28 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

434 kBTransfer

1203 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Indicators

tiki-indramayu.com Open in urlscan Pro
103.14.44.28 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

434 kB
Transfer

1203 kB
Size

1
Cookies

4 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!