urlscan.io logo urlscan.io
SecurityTrails logo

pkkmb.unmer.ac.id Open in urlscan Pro
103.177.141.30  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://pkkmb.unmer.ac.id/common/oauth2/
Submission: On December 04 via manual from IN — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 3 HTTP transactions. The main IP is 103.177.141.30, located in Malang, Indonesia and belongs to IDNIC-UNMER-AS-ID Universitas Merdeka Malang, ID. The main domain is pkkmb.unmer.ac.id.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on October 3rd 2022. Valid for: a year.
This is the only time pkkmb.unmer.ac.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
3 103.177.141.30 147157 (IDNIC-UNM...)
3 1
Apex Domain
Subdomains		 Transfer
3 unmer.ac.id
pkkmb.unmer.ac.id
14 KB
3 1
Domain Requested by
3 pkkmb.unmer.ac.id pkkmb.unmer.ac.id
3 1

This site contains no links.

Subject Issuer Validity Valid
*.unmer.ac.id
Sectigo RSA Domain Validation Secure Server CA		 2022-10-03 -
2023-10-27		 a year crt.sh

This page contains 1 frames:

Primary Page: https://pkkmb.unmer.ac.id/common/oauth2/
Frame ID: 8BCEF263BF685E788A014087BB665B42
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Microsoft account

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

14 kB
Transfer

19 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
pkkmb.unmer.ac.id/common/oauth2/ 		8 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pkkmb.unmer.ac.id/common/oauth2/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
103.177.141.30 Malang, Indonesia, ASN147157 (IDNIC-UNMER-AS-ID Universitas Merdeka Malang, ID),
Reverse DNS
Software
openresty / PHP/7.4.30
Resource Hash
1752093b212c2566e8bde5a66e95feabc0f66267fc377e336d699392416e23f8

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Sun, 04 Dec 2022 09:48:12 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
openresty
x-powered-by
PHP/7.4.30
x-served-by
pkkmb.unmer.ac.id
logo.svg
pkkmb.unmer.ac.id/common/oauth2/assets/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pkkmb.unmer.ac.id/common/oauth2/assets/logo.svg
Requested by
Host: pkkmb.unmer.ac.id
URL: https://pkkmb.unmer.ac.id/common/oauth2/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
103.177.141.30 Malang, Indonesia, ASN147157 (IDNIC-UNMER-AS-ID Universitas Merdeka Malang, ID),
Reverse DNS
Software
openresty /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pkkmb.unmer.ac.id/common/oauth2/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

expires
Mon, 05 Dec 2022 00:30:00 GMT
date
Sun, 04 Dec 2022 09:48:12 GMT
server
openresty
etag
"6388c18d-e43"
content-type
image/svg+xml
cache-control
max-age=52908
accept-ranges
bytes
content-length
3651
x-served-by
pkkmb.unmer.ac.id
/
pkkmb.unmer.ac.id/common/oauth2/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pkkmb.unmer.ac.id/common/oauth2/
Requested by
Host: pkkmb.unmer.ac.id
URL: https://pkkmb.unmer.ac.id/common/oauth2/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
103.177.141.30 Malang, Indonesia, ASN147157 (IDNIC-UNMER-AS-ID Universitas Merdeka Malang, ID),
Reverse DNS
Software
openresty / PHP/7.4.30
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pkkmb.unmer.ac.id/common/oauth2/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
date
Sun, 04 Dec 2022 09:48:12 GMT
content-encoding
gzip
server
openresty
x-powered-by
PHP/7.4.30
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
x-served-by
pkkmb.unmer.ac.id

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| validateForm

1 Cookies

Domain/Path Name / Value
pkkmb.unmer.ac.id/ Name: PHPSESSID
Value: b61e9b84fc881413682d1e43106c52f8

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

pkkmb.unmer.ac.id
103.177.141.30
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
1752093b212c2566e8bde5a66e95feabc0f66267fc377e336d699392416e23f8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855