bab1.sandromal.biz.id Open in urlscan Pro
104.21.51.240  Malicious Activity! Public Scan

URL: https://bab1.sandromal.biz.id/cindua/tapai/termsofservice.html
Submission: On October 09 via api from NL — Scanned from IT

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 104.21.51.240, located in and belongs to CLOUDFLARENET, US. The main domain is bab1.sandromal.biz.id.
TLS certificate: Issued by GTS CA 1P5 on September 27th 2023. Valid for: 3 months.
This is the only time bab1.sandromal.biz.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
9 104.21.51.240 13335 (CLOUDFLAR...)
9 2
Apex Domain
Subdomains
Transfer
9 sandromal.biz.id
bab1.sandromal.biz.id
310 KB
9 1
Domain Requested by
9 bab1.sandromal.biz.id bab1.sandromal.biz.id
9 1

This site contains no links.

Subject Issuer Validity Valid
sandromal.biz.id
GTS CA 1P5
2023-09-27 -
2023-12-26
3 months crt.sh

This page contains 1 frames:

Primary Page: https://bab1.sandromal.biz.id/cindua/tapai/termsofservice.html
Frame ID: 3000B3D4F83197934EFE43787E20F50F
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

Terms of Service

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

310 kB
Transfer

746 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request termsofservice.html
bab1.sandromal.biz.id/cindua/tapai/
15 KB
5 KB
Document
General
Full URL
https://bab1.sandromal.biz.id/cindua/tapai/termsofservice.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.51.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
856f032c378572c7ae8bc608638b20f19e5127122a2320016069344c5d8d2bba

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language
it-IT,it;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8136ab98a8170e29-MXP
content-encoding
br
content-type
text/html
date
Mon, 09 Oct 2023 12:36:37 GMT
last-modified
Mon, 11 Sep 2023 17:39:02 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H4U9uzfag7mA79BVd8GAJ0dEVOaWmMOrZ9suY9QMQgAgUAs4Ge0thfcawkFelGNbKGgO1fNlQY2XgD84zD9TbwJ8jUa5QfGK2y16LfEUlbPbkdyUNpK54TVz9LS8YeGVThHXFpt0P8U%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
sBXWJVtE_l6.css
bab1.sandromal.biz.id/cindua/tapai/css/
36 KB
10 KB
Stylesheet
General
Full URL
https://bab1.sandromal.biz.id/cindua/tapai/css/sBXWJVtE_l6.css
Requested by
Host: bab1.sandromal.biz.id
URL: https://bab1.sandromal.biz.id/cindua/tapai/termsofservice.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.51.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1c1648423329b6b28cffe0d7e4e37440b75508a6f6e294a43623f8480e4326ef

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://bab1.sandromal.biz.id/cindua/tapai/termsofservice.html
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 09 Oct 2023 12:36:37 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 18 Aug 2023 23:54:40 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1884
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eXahTglJdg48l3YdUfWbhmFNSlKg5VeLRbw%2FrimPiew79lR2gb8tSb41eKbjo89%2B9HKqboxclnSCs7M0%2FZfLhXayz7Ba7P9b2NJAeD%2BVqN35QFLwocrSgMqkMaUdUfAWhXYMn2ovcnM%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8136ab9948f30e29-MXP
alt-svc
h3=":443"; ma=86400
PQsdvTo0jWu.css
bab1.sandromal.biz.id/cindua/tapai/css/
37 KB
9 KB
Stylesheet
General
Full URL
https://bab1.sandromal.biz.id/cindua/tapai/css/PQsdvTo0jWu.css
Requested by
Host: bab1.sandromal.biz.id
URL: https://bab1.sandromal.biz.id/cindua/tapai/termsofservice.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.51.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a4eebaffa2a0f955b1c22963ce122d6b2721c06bb2de5fa598e5b6395877b208

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://bab1.sandromal.biz.id/cindua/tapai/termsofservice.html
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 09 Oct 2023 12:36:37 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 18 Aug 2023 23:55:16 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1884
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ATsct1dG1wnfj6wwDpFpxwkIC%2B%2BaOpVfzLWqXeoVIwgVdipDs13HTSpYL2xAvp184SFmlbw9XVzZHmW8qB27L67988nwZ5q%2F840IIhCfC6OE3ig6vOtV%2FFQ3jm4gU0xwfbT5qLxwFg4%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8136ab9948f80e29-MXP
alt-svc
h3=":443"; ma=86400
9S6WONSXioV.css
bab1.sandromal.biz.id/cindua/tapai/css/
810 B
646 B
Stylesheet
General
Full URL
https://bab1.sandromal.biz.id/cindua/tapai/css/9S6WONSXioV.css
Requested by
Host: bab1.sandromal.biz.id
URL: https://bab1.sandromal.biz.id/cindua/tapai/termsofservice.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.51.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ed25d38dd96abfe8f674faa19436788b55109095ca63725fb1210e4f1f5a0fea

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://bab1.sandromal.biz.id/cindua/tapai/termsofservice.html
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 09 Oct 2023 12:36:37 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 18 Aug 2023 23:55:46 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1884
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mIrDS6S6rtcozPygvMS62fgpQPhDZt7SNFngw4Ow%2Fft1EAdhVu6%2FrcMbJgQ615MRi%2FZk2RjCN46YlMwk4dSMVrd04ZfJAiO54auhx8X95O5oP7m65x1Lgt2S8Dbf6vnzP4bV4fNtkiw%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8136ab9948fb0e29-MXP
alt-svc
h3=":443"; ma=86400
vRqE9ubQhYU.css
bab1.sandromal.biz.id/cindua/tapai/css/
27 KB
6 KB
Stylesheet
General
Full URL
https://bab1.sandromal.biz.id/cindua/tapai/css/vRqE9ubQhYU.css
Requested by
Host: bab1.sandromal.biz.id
URL: https://bab1.sandromal.biz.id/cindua/tapai/termsofservice.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.51.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
df9f33ffded27b0f002ed79860a184c3205b52d8a9c43d01833faba8a9c4bfda

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://bab1.sandromal.biz.id/cindua/tapai/termsofservice.html
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 09 Oct 2023 12:36:37 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 18 Aug 2023 23:56:14 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1884
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IT8skuuR0uwl4x9eeZTYqKYcFqZObKPdlm4GxbDrD7ZLXjcLb0V3b%2FMMDVfgr8Xczw9kifYfvugfZHpkzu2XfaifB3qETCuMnGtQ0BHTeHTGMPT1jPRBQsCYGJBbBuxiBW1zNMtd7Ko%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8136ab9948fc0e29-MXP
alt-svc
h3=":443"; ma=86400
style-pay.css
bab1.sandromal.biz.id/cindua/tapai/css/
44 KB
5 KB
Stylesheet
General
Full URL
https://bab1.sandromal.biz.id/cindua/tapai/css/style-pay.css
Requested by
Host: bab1.sandromal.biz.id
URL: https://bab1.sandromal.biz.id/cindua/tapai/termsofservice.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.51.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
88c5d4bbfd88778f114aaec06162bb779759ca30339703c4c7e6e294169f560d

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://bab1.sandromal.biz.id/cindua/tapai/termsofservice.html
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 09 Oct 2023 12:36:37 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 18 Aug 2023 23:56:46 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1884
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TliJ6d6xHVoN%2BMR0F4lJX4hfaxChnh6kryIl4XCfxZbsGR%2F6vm4QtAT5XX6dJboZxPCnRAvs9M4AFaz45GUTfWhDymADQ6kvaZ4sLk5GaGCaqpgXILuLxApyN9qj45g%2FdAoIjvQ771Q%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8136ab9948fe0e29-MXP
alt-svc
h3=":443"; ma=86400
pAy5sS6Se6DC.css
bab1.sandromal.biz.id/cindua/tapai/css/
446 KB
133 KB
Stylesheet
General
Full URL
https://bab1.sandromal.biz.id/cindua/tapai/css/pAy5sS6Se6DC.css
Requested by
Host: bab1.sandromal.biz.id
URL: https://bab1.sandromal.biz.id/cindua/tapai/termsofservice.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.51.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
23431b442c844f7284d5acd0e4636400941659175df1991e3db406444553c99b

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://bab1.sandromal.biz.id/cindua/tapai/termsofservice.html
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 09 Oct 2023 12:36:37 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 18 Aug 2023 23:57:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1884
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V7tp0z5HwK6f%2FQBll3wK%2BPVAV8toY2KUC05%2FKuvO3pUErE1%2FOH6NVjU5U11XJHyQGOnhHtzy9Jk40027oDiQVvqoatS11H5mBLYn64coYbReHg2%2BPgJ%2BLX72Sh2SrI9DmkPilTXQiNE%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8136ab9948ff0e29-MXP
alt-svc
h3=":443"; ma=86400
a.png
bab1.sandromal.biz.id/cindua/tapai/img/
24 KB
24 KB
Image
General
Full URL
https://bab1.sandromal.biz.id/cindua/tapai/img/a.png
Requested by
Host: bab1.sandromal.biz.id
URL: https://bab1.sandromal.biz.id/cindua/tapai/termsofservice.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.51.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d7a879ae5ca10bfd663c1fd65b79e4df0ef0d9d0bc76183a3acd57dae4602dcd

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://bab1.sandromal.biz.id/cindua/tapai/termsofservice.html
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 09 Oct 2023 12:36:38 GMT
cf-cache-status
HIT
last-modified
Mon, 11 Sep 2023 17:33:18 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1885
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4RDK%2B4UMcMAXC0td%2BsLUhZrz41fwKoIuBxlTqFSt34pB4dB7Ta7Ch78hIlRJzjYTMNPARDNguiVhPoN9mhgkPDgV9v0YRigjOeQeu0SfVime%2FtpEC%2BUmFpENbMZ0e8N2MGdwDDPBUFU%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8136ab99e9f40e29-MXP
alt-svc
h3=":443"; ma=86400
content-length
24451
101492-blue-security.gif
bab1.sandromal.biz.id/cindua/tapai/img/
117 KB
117 KB
Image
General
Full URL
https://bab1.sandromal.biz.id/cindua/tapai/img/101492-blue-security.gif
Requested by
Host: bab1.sandromal.biz.id
URL: https://bab1.sandromal.biz.id/cindua/tapai/termsofservice.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.51.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1a28452270079f7834854b18270302bb15e53a0690ff3519a0b1beb93f0b05a4

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://bab1.sandromal.biz.id/cindua/tapai/termsofservice.html
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 09 Oct 2023 12:36:38 GMT
cf-cache-status
HIT
last-modified
Mon, 11 Sep 2023 17:32:46 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1885
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PK1v%2BPhQneEZ226sLLWDrc1o1Fxj4uF8PRRqgymqtbtT7Rm%2BrvkeF2wW%2BM43YR8Pq6R4g37wijI8L4e5CBxBqF%2BlD2hef2AOzxvD0H2jrxLhUMUp1mnAgvMEIEGfAitQDVm8ksUpKFI%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8136ab9a4a790e29-MXP
alt-svc
h3=":443"; ma=86400
content-length
119376
truncated
/
135 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c2128b5b8a9ea02f0830a3b22c37023dae3f287e7ef5d91fbb4ff535c6b30675

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| mousedwn string| tanggallengkap object| namahari object| namabulan object| tgl number| hari number| tanggal number| bulan number| tahun

0 Cookies