www.upgris.ac.id Open in urlscan Pro
2606:4700:3035::6812:39a0 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://u.to/N0PXFw
Effective URL:
https://www.upgris.ac.id/ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.php/kpf/ymet/?9th9w9...
Submission: On March 19 via manual (March 19th 2020, 6:50:15 pm UTC) from SA

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 9 HTTP transactions. The main IP is 2606:4700:3035::6812:39a0, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.upgris.ac.id.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on January 30th 2020. Valid for: 8 months.

This is the only time www.upgris.ac.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Lion's Den Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	195.216.243.155 195.216.243.155	57724 (DDOS-GUARD) (DDOS-GUARD)
1 1	2001:1528:225... 2001:1528:225::a:34	15685 (CASABLANC...) (CASABLANCA-AS Internet & Collocation Provider)
2	2606:4700:303... 2606:4700:3035::6812:39a0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 5	2a02:6b8::1:119 2a02:6b8::1:119	13238 (YANDEX) (YANDEX)
1 2	88.212.201.216 88.212.201.216	39134 (UNITEDNET) (UNITEDNET)
1	2606:4700::68... 2606:4700::6811:4004	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	6

1 195.216.243.155 (Moscow, Russian Federation)

ASN57724 (DDOS-GUARD, RU)
PTR: s5.unet.com

u.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:1528:225::a:34 (Czech Republic) 1 redirects

ASN15685 (CASABLANCA-AS Internet & Collocation Provider, CZ)

zadarmo.cz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3035::6812:39a0 (United States)

ASN13335 (CLOUDFLARENET, US)

www.upgris.ac.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:6b8::1:119 (Moscow, Russian Federation) 1 redirects

ASN13238 (YANDEX, RU)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.212.201.216 (Russian Federation) 1 redirects

ASN39134 (UNITEDNET, RU)
PTR: host216.rax.ru

counter.yadro.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:4004 (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	yandex.ru 1 redirects mc.yandex.ru	95 KB
2	yadro.ru 1 redirects counter.yadro.ru	877 B
2	upgris.ac.id www.upgris.ac.id	1 KB
1	cloudflare.com cdnjs.cloudflare.com	30 KB
1	zadarmo.cz 1 redirects zadarmo.cz	338 B
1	u.to u.to	1 KB
9	6

	Domain	Requested by
5	mc.yandex.ru	1 redirects u.to
2	counter.yadro.ru	1 redirects
2	www.upgris.ac.id	u.to
1	cdnjs.cloudflare.com	www.upgris.ac.id
1	zadarmo.cz	1 redirects
1	u.to
9	6

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-01-30` - `2020-10-09`	8 months	crt.sh
mc.yandex.ru Yandex CA	`2019-09-23` - `2020-09-22`	a year	crt.sh
cloudflare.com CloudFlare Inc ECC CA-2	`2020-01-07` - `2020-10-09`	9 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.upgris.ac.id/ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.php/kpf/ymet/?9th9w9r9z0
Frame ID: 67E4573B6B9B4B531635269EE24EE484
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://u.to/N0PXFw Page URL
http://zadarmo.cz/bkm_redirect.php?bkm_id=684&url=https://www.upgris.ac.id/ppg_info/assets2/ck... HTTP 302
https://www.upgris.ac.id/ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.... Page URL
https://www.upgris.ac.id/ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

9
Requests

78 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

6
IPs

3
Countries

126 kB
Transfer

773 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://u.to/N0PXFw Page URL
http://zadarmo.cz/bkm_redirect.php?bkm_id=684&url=https://www.upgris.ac.id/ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.php/hqxem/rsh/?love=h1t1rs10zcu0e HTTP 302
https://www.upgris.ac.id/ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.php/hqxem/rsh/?love=h1t1rs10zcu0e Page URL
https://www.upgris.ac.id/ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.php/kpf/ymet/?9th9w9r9z0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

http://zadarmo.cz/bkm_redirect.php?bkm_id=684&url=https://www.upgris.ac.id/ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.php/hqxem/rsh/?love=h1t1rs10zcu0e HTTP 302
https://www.upgris.ac.id/ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.php/hqxem/rsh/?love=h1t1rs10zcu0e

Request Chain 3

http://counter.yadro.ru/hit;utostat?r;s1600*1200*24;uhttp%3A//u.to/N0PXFw;1584643796911 HTTP 302
http://counter.yadro.ru/hit;utostat?q;r;s1600*1200*24;uhttp%3A//u.to/N0PXFw;1584643796911

Request Chain 4

https://mc.yandex.ru/watch/51604940?wmode=7&page-url=http%3A%2F%2Fu.to%2FN0PXFw&charset=utf-8&browser-info=ti%3A10%3Ans%3A1584643796768%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A60%3Ai%3A20200319194957%3Aet%3A1584643797%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A25139792%3Ahid%3A557371012%3Ads%3A1%2C17%2C114%2C2%2C0%2C0%2C0%2C%2C%2C144%2C%2C%2C%3Agdpr%3A14%3Av%3A1819%3Awv%3A2%3Ast%3A1584643797%3Au%3A1584643797826356430%3At%3ARedirecting HTTP 302
https://mc.yandex.ru/watch/51604940/1?wmode=7&page-url=http%3A%2F%2Fu.to%2FN0PXFw&charset=utf-8&browser-info=ti%3A10%3Ans%3A1584643796768%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A60%3Ai%3A20200319194957%3Aet%3A1584643797%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A25139792%3Ahid%3A557371012%3Ads%3A1%2C17%2C114%2C2%2C0%2C0%2C0%2C%2C%2C144%2C%2C%2C%3Agdpr%3A14%3Av%3A1819%3Awv%3A2%3Ast%3A1584643797%3Au%3A1584643797826356430%3At%3ARedirecting

9 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Cookie set N0PXFw Show response
u.to/ 1 KB
1 KB 133ms
115ms Document
text/html 195.216.243.155
DDOS-GUARD

General

Check archive.org

Show headers Download Go to

Full URL: http://u.to/N0PXFw
Protocol: HTTP/1.1
Server: 195.216.243.155 Moscow, Russian Federation, ASN57724 (DDOS-GUARD, RU),
Reverse DNS: s5.unet.com
Software: nginx/1.8.0 /
Resource Hash: 27f387ef00a181ce2ca021bb1f24f432e08906c6943d946dc06021fbf5a90d45

Request headers

Host: u.to
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: nginx/1.8.0
Date: Thu, 19 Mar 2020 18:49:56 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=15
Set-Cookie: lng=en; path=/; expires=Fri, 19-Mar-2021 18:49:56 GMT; domain=.u.to;
Cache-Control: no-cache no-store
Pragma: no-cache
Vary: host
Content-Encoding: gzip

GET
H2

200

/ Show response
www.upgris.ac.id/ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.php/hqxem/rsh/
Redirect Chain

http://zadarmo.cz/bkm_redirect.php?bkm_id=684&url=https://www.upgris.ac.id/ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.php/hqxem/rsh/?love=h1t1rs10zcu0e
https://www.upgris.ac.id/ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.php/hqxem/rsh/?love=h1t1rs10zcu0e

3 KB
1 KB

864ms
831ms

Document
text/html

2606:4700:3035::6812:39a0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.upgris.ac.id/ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.php/hqxem/rsh/?love=h1t1rs10zcu0e
Requested by: Host: u.to
URL: http://u.to/N0PXFw
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:39a0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.5.9-1ubuntu4.16
Resource Hash: e50438ab92130cc71ec9ebb00b20446e4dbd3d22380d95c52094d456b21b3ca7

Request headers

:method: GET
:authority: www.upgris.ac.id
:scheme: https
:path: /ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.php/hqxem/rsh/?love=h1t1rs10zcu0e
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: http://u.to/N0PXFw
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://u.to/N0PXFw

Response headers

status: 200
date: Thu, 19 Mar 2020 18:49:57 GMT
content-type: text/html
set-cookie: __cfduid=db8a1f874c1831cf8d666a7ffae7693fb1584643797; expires=Sat, 18-Apr-20 18:49:57 GMT; path=/; domain=.upgris.ac.id; HttpOnly; SameSite=Lax; Secure
x-powered-by: PHP/5.5.9-1ubuntu4.16
vary: Accept-Encoding
cache-control: max-age=2592000
expires: Sat, 18 Apr 2020 18:49:57 GMT
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 576960533a76971e-FRA
content-encoding: br

Redirect headers

Date: Thu, 19 Mar 2020 18:49:56 GMT
Server: Apache/2.4.25 (Debian)
Location: https://www.upgris.ac.id/ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.php/hqxem/rsh/?love=h1t1rs10zcu0e
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html

GET
H/1.1 200
OK tag.js
mc.yandex.ru/metrika/ 363 KB
92 KB 162ms
79ms Script
application/javascript 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/tag.js

Requested by

Host: u.to
URL: http://u.to/N0PXFw

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://u.to/N0PXFw
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 19 Mar 2020 18:49:57 GMT
Content-Encoding: br
Last-Modified: Tue, 10 Mar 2020 15:04:37 GMT
Server: nginx/1.14.2
ETag: "5e67ac85-16ecc"
Strict-Transport-Security: max-age=31536000
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Content-Length: 93900
Expires: Thu, 19 Mar 2020 19:49:57 GMT

GET
H/1.1

200
OK

hit;utostat
counter.yadro.ru/
Redirect Chain

http://counter.yadro.ru/hit;utostat?r;s1600*1200*24;uhttp%3A//u.to/N0PXFw;1584643796911
http://counter.yadro.ru/hit;utostat?q;r;s1600*1200*24;uhttp%3A//u.to/N0PXFw;1584643796911

43 B
411 B

54ms
54ms

Image
image/gif

88.212.201.216
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://counter.yadro.ru/hit;utostat?q;r;s1600*1200*24;uhttp%3A//u.to/N0PXFw;1584643796911
Protocol: HTTP/1.1
Server: 88.212.201.216 , Russian Federation, ASN39134 (UNITEDNET, RU),
Reverse DNS: host216.rax.ru
Software: 0W/0.8c /
Resource Hash

Request headers

Referer: http://u.to/N0PXFw
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 19 Mar 2020 18:49:57 GMT
Server: 0W/0.8c
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Cache-control: no-cache
Connection: Close
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 19 Mar 2019 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 19 Mar 2020 18:49:56 GMT
Server: 0W/0.8c
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Location: http://counter.yadro.ru/hit;utostat?q;r;s1600*1200*24;uhttp%3A//u.to/N0PXFw;1584643796911
Cache-control: no-cache
Content-Type: text/html
Content-Length: 32
Expires: Tue, 19 Mar 2019 21:00:00 GMT

GET
H/1.1

302
Found

1
mc.yandex.ru/watch/51604940/
Redirect Chain

https://mc.yandex.ru/watch/51604940?wmode=7&page-url=http%3A%2F%2Fu.to%2FN0PXFw&charset=utf-8&browser-info=ti%3A10%3Ans%3A1584643796768%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3A...
https://mc.yandex.ru/watch/51604940/1?wmode=7&page-url=http%3A%2F%2Fu.to%2FN0PXFw&charset=utf-8&browser-info=ti%3A10%3Ans%3A1584643796768%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%...

0
-1 B

40ms
40ms

XHR

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/watch/51604940/1?wmode=7&page-url=http%3A%2F%2Fu.to%2FN0PXFw&charset=utf-8&browser-info=ti%3A10%3Ans%3A1584643796768%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A60%3Ai%3A20200319194957%3Aet%3A1584643797%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A25139792%3Ahid%3A557371012%3Ads%3A1%2C17%2C114%2C2%2C0%2C0%2C0%2C%2C%2C144%2C%2C%2C%3Agdpr%3A14%3Av%3A1819%3Awv%3A2%3Ast%3A1584643797%3Au%3A1584643797826356430%3At%3ARedirecting

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: http://u.to/N0PXFw
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 19 Mar 2020 18:49:57 GMT
Last-Modified: Thu, 19-Mar-2020 18:49:57 GMT
Server: nginx/1.14.2
Location: /watch/51604940/1?wmode=7&page-url=http%3A%2F%2Fu.to%2FN0PXFw&charset=utf-8&browser-info=ti%3A10%3Ans%3A1584643796768%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A60%3Ai%3A20200319194957%3Aet%3A1584643797%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A25139792%3Ahid%3A557371012%3Ads%3A1%2C17%2C114%2C2%2C0%2C0%2C0%2C%2C%2C144%2C%2C%2C%3Agdpr%3A14%3Av%3A1819%3Awv%3A2%3Ast%3A1584643797%3Au%3A1584643797826356430%3At%3ARedirecting
Strict-Transport-Security: max-age=31536000
Access-Control-Allow-Origin: http://u.to
Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
X-XSS-Protection: 1; mode=block
Expires: Thu, 19-Mar-2020 18:49:57 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 19 Mar 2020 18:49:57 GMT
Last-Modified: Thu, 19-Mar-2020 18:49:57 GMT
Server: nginx/1.14.2
Access-Control-Allow-Origin: http://u.to
Strict-Transport-Security: max-age=31536000
Location: /watch/51604940/1?wmode=7&page-url=http%3A%2F%2Fu.to%2FN0PXFw&charset=utf-8&browser-info=ti%3A10%3Ans%3A1584643796768%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A60%3Ai%3A20200319194957%3Aet%3A1584643797%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A25139792%3Ahid%3A557371012%3Ads%3A1%2C17%2C114%2C2%2C0%2C0%2C0%2C%2C%2C144%2C%2C%2C%3Agdpr%3A14%3Av%3A1819%3Awv%3A2%3Ast%3A1584643797%3Au%3A1584643797826356430%3At%3ARedirecting
Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
X-XSS-Protection: 1; mode=block
Expires: Thu, 19-Mar-2020 18:49:57 GMT

GET
H/1.1 200
OK advert.gif
mc.yandex.ru/metrika/ 43 B
425 B 78ms
40ms Image
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.ru/metrika/advert.gif

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://u.to/N0PXFw
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Thu, 19 Mar 2020 18:49:57 GMT
Last-Modified: Fri, 17 Jan 2020 08:05:01 GMT
Server: nginx/1.14.2
ETag: "5e216aad-2b"
Strict-Transport-Security: max-age=31536000
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Thu, 19 Mar 2020 19:49:57 GMT

GET
H/1.1 200
OK 1
mc.yandex.ru/watch/51604940/ 152 B
691 B 87ms
46ms XHR
application/json 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://u.to/N0PXFw
Origin: http://u.to
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Thu, 19 Mar 2020 18:49:57 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 19-Mar-2020 18:49:57 GMT
Server: nginx/1.14.2
Strict-Transport-Security: max-age=31536000
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: http://u.to
Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 152
X-XSS-Protection: 1; mode=block
Expires: Thu, 19-Mar-2020 18:49:57 GMT

GET
H2 200 Primary Request /
www.upgris.ac.id/ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.php/kpf/ymet/ 253 KB
0 11003ms
11002ms Document
text/html 2606:4700:3035::6812:39a0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.upgris.ac.id/ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.php/kpf/ymet/?9th9w9r9z0
Requested by: Host: u.to
URL: http://u.to/N0PXFw
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:39a0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.5.9-1ubuntu4.16
Resource Hash

Request headers

:method: GET
:authority: www.upgris.ac.id
:scheme: https
:path: /ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.php/kpf/ymet/?9th9w9r9z0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
referer: https://www.upgris.ac.id/ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.php/hqxem/rsh/?love=h1t1rs10zcu0e
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=db8a1f874c1831cf8d666a7ffae7693fb1584643797
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Referer: https://www.upgris.ac.id/ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.php/hqxem/rsh/?love=h1t1rs10zcu0e

Response headers

status: 200
date: Thu, 19 Mar 2020 18:50:09 GMT
content-type: text/html
x-powered-by: PHP/5.5.9-1ubuntu4.16
vary: Accept-Encoding
cache-control: max-age=2592000
expires: Sat, 18 Apr 2020 18:49:59 GMT
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5769605ecf9b971e-FRA
content-encoding: br

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/ 86 KB
30 KB 18ms
18ms Script
application/javascript 2606:4700::6811:4004
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js

Requested by

Host: www.upgris.ac.id
URL: https://www.upgris.ac.id/ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.php/kpf/ymet/?9th9w9r9z0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4004 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://www.upgris.ac.id/ppg_info/assets2/ckeditor/plugins/a11yhelp/dialogs/lang/catgames/traceroute.php/kpf/ymet/?9th9w9r9z0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 19 Mar 2020 18:50:10 GMT
content-encoding: br
cf-cache-status: HIT
age: 20602945
cf-ray: 576960a49b8cdff3-FRA
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
last-modified: Wed, 01 May 2019 21:45:59 GMT
server: cloudflare
etag: W/"5cca1397-15851"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Tue, 09 Mar 2021 18:50:10 GMT
cache-control: public, max-age=30672000
timing-allow-origin: *
served-in-seconds: 0.003

GET
DATA 200
OK truncated
/ 8 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 739316d522834ada80b44c074610c183b02b962f01f405a73e9f00945e1f648e

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 24 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6d1c61c97d0d24827499d8b1d4b963e70e689d0eda84dc688a7e4e01256233fa

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ 20 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1ce69bebf4571c44d25e71ad2a146c63c6bd42b803cfbf1e168b30ebcd82317b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ 15 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2ad5c8e321d1a26b213f91e3b8f0a5390aa10574d4f26b71fdd6ed8b7b210a26

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Lion's Den Scam (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.upgris.ac.id/	1970-01-19 08:53:55	Name: __cfduid Value: db8a1f874c1831cf8d666a7ffae7693fb1584643797

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
counter.yadro.ru
mc.yandex.ru
u.to
www.upgris.ac.id
zadarmo.cz
195.216.243.155
2001:1528:225::a:34
2606:4700:3035::6812:39a0
2606:4700::6811:4004
2a02:6b8::1:119
88.212.201.216
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
1ce69bebf4571c44d25e71ad2a146c63c6bd42b803cfbf1e168b30ebcd82317b
27f387ef00a181ce2ca021bb1f24f432e08906c6943d946dc06021fbf5a90d45
2ad5c8e321d1a26b213f91e3b8f0a5390aa10574d4f26b71fdd6ed8b7b210a26
6d1c61c97d0d24827499d8b1d4b963e70e689d0eda84dc688a7e4e01256233fa
739316d522834ada80b44c074610c183b02b962f01f405a73e9f00945e1f648e
e50438ab92130cc71ec9ebb00b20446e4dbd3d22380d95c52094d456b21b3ca7

www.upgris.ac.id Open in urlscan Pro 2606:4700:3035::6812:39a0 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

78 %HTTPS

67 %IPv6

6 Domains

6 Subdomains

6 IPs

3 Countries

126 kBTransfer

773 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

www.upgris.ac.id Open in urlscan Pro
2606:4700:3035::6812:39a0 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

78 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

6
IPs

3
Countries

126 kB
Transfer

773 kB
Size

1
Cookies

9 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!