urlscan.io logo urlscan.io
SecurityTrails logo

imbi.or.id Open in urlscan Pro
103.30.147.43  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://agsts-globalapps.msaouthofficee.com/
Effective URL: https://imbi.or.id/ex/success.html
Submission: On August 19 via manual from GB — Scanned from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 2 HTTP transactions. The main IP is 103.30.147.43, located in Indonesia and belongs to JOGJACAMP-AS-ID PT JC Indonesia, ID. The main domain is imbi.or.id.
TLS certificate: Issued by R3 on June 30th 2022. Valid for: 3 months.
This is the only time imbi.or.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

IP Address AS Autonomous System
2 2 54.221.77.34 14618 (AMAZON-AES)
1 103.30.147.43 46050 (JOGJACAMP...)
1 2600:9000:223... 16509 (AMAZON-02)
2 3
Domain Requested by
2 agsts-globalapps.msaouthofficee.com 2 redirects
1 d1rytvr7gmk1sx.cloudfront.net imbi.or.id
1 imbi.or.id
2 3

This site contains no links.

Subject Issuer Validity Valid
imbi.or.id
R3		 2022-06-30 -
2022-09-28		 3 months crt.sh
*.cloudfront.net
Amazon		 2022-02-01 -
2023-01-31		 a year crt.sh

This page contains 1 frames:

Primary Page: https://imbi.or.id/ex/success.html
Frame ID: 265CC3249D350916C09CFA0872D643D3
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Microsoft

Page URL History Show full URLs

  1. http://agsts-globalapps.msaouthofficee.com/ HTTP 302
    https://agsts-globalapps.msaouthofficee.com/ HTTP 302
    https://imbi.or.id/ex/success.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Page Statistics

2
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

72 kB
Transfer

111 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://agsts-globalapps.msaouthofficee.com/ HTTP 302
    https://agsts-globalapps.msaouthofficee.com/ HTTP 302
    https://imbi.or.id/ex/success.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request success.html
imbi.or.id/ex/
Redirect Chain
  • http://agsts-globalapps.msaouthofficee.com/
  • https://agsts-globalapps.msaouthofficee.com/
  • https://imbi.or.id/ex/success.html
46 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imbi.or.id/ex/success.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
103.30.147.43 , Indonesia, ASN46050 (JOGJACAMP-AS-ID PT JC Indonesia, ID),
Reverse DNS
sekarsuli.idweb.host
Software
LiteSpeed /
Resource Hash
f80ab2445be98f27caada5bb83b99b24d6477830fe04798fc9025742a8ae5059

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-length
17058
content-type
text/html
date
Fri, 19 Aug 2022 11:13:48 GMT
last-modified
Mon, 04 Jul 2022 15:58:51 GMT
server
LiteSpeed
vary
Accept-Encoding

Redirect headers

Connection
close
Content-Type
text/html
Location
https://imbi.or.id/ex/success.html
Transfer-Encoding
chunked
new-microsoft365-logo-horiz-c-gray-rgb.jpg
d1rytvr7gmk1sx.cloudfront.net/wp-content/uploads/2020/04/ 		55 KB
55 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d1rytvr7gmk1sx.cloudfront.net/wp-content/uploads/2020/04/new-microsoft365-logo-horiz-c-gray-rgb.jpg?x24468
Requested by
Host: imbi.or.id
URL: https://imbi.or.id/ex/success.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:7a00:1b:5a63:840:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d2df7f0bf7c15eddf3635d3103b10b0b7b8f7f6ffbd24ca24c32cb6b8b9b9c2e

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://imbi.or.id/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-amz-version-id
RqIhBfnFSJ9RPkRmbhPz6jO41c.D5qUn
via
1.1 34fdfb7c7c11559df7e622af2b62f5ca.cloudfront.net (CloudFront)
last-modified
Tue, 03 May 2022 20:41:05 GMT
server
AmazonS3
age
1000
etag
"71a76156fdf73d5d74dcabe12d89044e"
x-cache
Hit from cloudfront
content-type
binary/octet-stream
x-amz-meta-processed
true
cache-control
must-revalidate, public, max-age=1800
date
Fri, 19 Aug 2022 10:57:09 GMT
x-amz-cf-pop
FRA56-P4
accept-ranges
bytes
content-length
56088
x-amz-cf-id
xa_rwJ7S6o98pioa8E7zjRAUBKbvMKWUJi33LMijPkj__mpcIey1sQ==
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		816 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dd1665c0084b5cc097293ff0da9ee89e584e81d9fa64050c020a4f606eb67b2e

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation number| a_fRC string| a_sUrl string| a_sCW string| a_sLgn object| mainLogonDiv

0 Cookies