blitarcab.dindik.jatimprov.go.id Open in urlscan Pro
103.106.74.14 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/?i=i&0=contact@sceneworld.org
Effective URL:
https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/e5vtnwf8umqpkm76hx9oardrzt.php?0=&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWh...
Submission: On December 01 via automatic, source phishtank (December 1st 2021, 9:38:53 am UTC) — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 9 HTTP transactions. The main IP is 103.106.74.14, located in Indonesia and belongs to IDNIC-JATIM-AS-ID Dinas Komunikasi dan Informatika Provinsi jawa timur, ID. The main domain is blitarcab.dindik.jatimprov.go.id.
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 13th 2021. Valid for: 3 months.

This is the only time blitarcab.dindik.jatimprov.go.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 7	103.106.74.14 103.106.74.14	136884 (IDNIC-JAT...) (IDNIC-JATIM-AS-ID Dinas Komunikasi dan Informatika Provinsi jawa timur)
1	2a00:1450:400... 2a00:1450:4001:829::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
9	4

7 103.106.74.14 (Indonesia) 1 redirects

ASN136884 (IDNIC-JATIM-AS-ID Dinas Komunikasi dan Informatika Provinsi jawa timur, ID)

blitarcab.dindik.jatimprov.go.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	jatimprov.go.id 1 redirects blitarcab.dindik.jatimprov.go.id	288 KB
1	gstatic.com fonts.gstatic.com	21 KB
1	googleapis.com fonts.googleapis.com	1021 B
9	3

	Domain	Requested by
7	blitarcab.dindik.jatimprov.go.id	1 redirects blitarcab.dindik.jatimprov.go.id
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	blitarcab.dindik.jatimprov.go.id
9	3

This site contains no links.

Subject Issuer	Validity	Valid
blitarcab.dindik.jatimprov.go.id cPanel, Inc. Certification Authority	`2021-09-13` - `2021-12-12`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh

This page contains 1 frames:

Frame: https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/nlkiu3sdvp3ztxj9dq1vqcxjro.php?0=&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_
Frame ID: A5B16569068FF3D4F10065A6AF143C9C
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Detecting Mail Server...

Page URL History Show full URLs

https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/?i=i&0=contact@sceneworld.org HTTP 302
https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/e5vtnwf8umqpkm76hx9oardrzt.php?0=&.verify??guce_referrer=aHR... Page URL

Page Statistics

9
Requests

89 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

310 kB
Transfer

309 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/?i=i&0=contact@sceneworld.org HTTP 302
https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/e5vtnwf8umqpkm76hx9oardrzt.php?0=&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7

https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/load.php?0=&guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENc HTTP 302
https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/nlkiu3sdvp3ztxj9dq1vqcxjro.php?0=&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request e5vtnwf8umqpkm76hx9oardrzt.php Show response
blitarcab.dindik.jatimprov.go.id/.well-known/xvx/
Redirect Chain

https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/?i=i&0=contact@sceneworld.org
https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/e5vtnwf8umqpkm76hx9oardrzt.php?0=&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjc...

746 B
917 B

641ms
218ms

Document
text/html

103.106.74.14
IDNIC-JATIM-AS-ID...

General

Check archive.org

Show headers Download Go to

Full URL: https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/e5vtnwf8umqpkm76hx9oardrzt.php?0=&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 103.106.74.14 , Indonesia, ASN136884 (IDNIC-JATIM-AS-ID Dinas Komunikasi dan Informatika Provinsi jawa timur, ID),
Reverse DNS
Software: Apache /
Resource Hash: 6257009114a4bb937f235be0a39293479ebdc719117d0e80480429f619ac04dd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Wed, 01 Dec 2021 09:38:48 GMT
Server: Apache
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Wed, 01 Dec 2021 09:38:47 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Location: e5vtnwf8umqpkm76hx9oardrzt.php?0=&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK background_styles.css
blitarcab.dindik.jatimprov.go.id/.well-known/xvx/cache/ 472 B
676 B 623ms
209ms Stylesheet
text/css 103.106.74.14
IDNIC-JATIM-AS-ID...

General

Check archive.org

Show headers Download Go to

Full URL: https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/cache/background_styles.css
Requested by: Host: blitarcab.dindik.jatimprov.go.id
URL: https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/e5vtnwf8umqpkm76hx9oardrzt.php?0=&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 103.106.74.14 , Indonesia, ASN136884 (IDNIC-JATIM-AS-ID Dinas Komunikasi dan Informatika Provinsi jawa timur, ID),
Reverse DNS
Software: Apache /
Resource Hash: 58151938b48f02077ac1809421826b735dfac46f13cb3e1494938447d99b604e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/e5vtnwf8umqpkm76hx9oardrzt.php?0=&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 01 Dec 2021 09:38:48 GMT
Last-Modified: Wed, 21 Aug 2019 15:42:02 GMT
Server: Apache
Connection: close
Accept-Ranges: bytes
Content-Length: 472
Content-Type: text/css

GET
H/1.1 200
OK styles.css
blitarcab.dindik.jatimprov.go.id/.well-known/xvx/cache/ 474 B
678 B 648ms
218ms Stylesheet
text/css 103.106.74.14
IDNIC-JATIM-AS-ID...

General

Check archive.org

Show headers Download Go to

Full URL: https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/cache/styles.css
Requested by: Host: blitarcab.dindik.jatimprov.go.id
URL: https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/e5vtnwf8umqpkm76hx9oardrzt.php?0=&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 103.106.74.14 , Indonesia, ASN136884 (IDNIC-JATIM-AS-ID Dinas Komunikasi dan Informatika Provinsi jawa timur, ID),
Reverse DNS
Software: Apache /
Resource Hash: d6fc3d1520a00be1c8c8cb060a85bdb76f8daa6596e58d2b2a977ea67bb0a886

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/e5vtnwf8umqpkm76hx9oardrzt.php?0=&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 01 Dec 2021 09:38:48 GMT
Last-Modified: Wed, 21 Aug 2019 09:35:10 GMT
Server: Apache
Connection: close
Accept-Ranges: bytes
Content-Length: 474
Content-Type: text/css

GET
H/1.1 200
OK script.js Show response
blitarcab.dindik.jatimprov.go.id/.well-known/xvx/cache/ 280 B
498 B 657ms
221ms Script
application/javascript 103.106.74.14
IDNIC-JATIM-AS-ID...

General

Check archive.org

Show headers Download Go to

Full URL: https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/cache/script.js
Requested by: Host: blitarcab.dindik.jatimprov.go.id
URL: https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/e5vtnwf8umqpkm76hx9oardrzt.php?0=&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 103.106.74.14 , Indonesia, ASN136884 (IDNIC-JATIM-AS-ID Dinas Komunikasi dan Informatika Provinsi jawa timur, ID),
Reverse DNS
Software: Apache /
Resource Hash: 92fd40762d767ac7711c39b19506d470d901d31c8ac193499b3b673ec1261396

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/e5vtnwf8umqpkm76hx9oardrzt.php?0=&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 01 Dec 2021 09:38:48 GMT
Last-Modified: Wed, 21 Aug 2019 04:07:04 GMT
Server: Apache
Connection: close
Accept-Ranges: bytes
Content-Length: 280
Content-Type: application/javascript

GET
H2 200 css
fonts.googleapis.com/ 2 KB
1021 B 39ms
16ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway

Requested by

Host: blitarcab.dindik.jatimprov.go.id
URL: https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/cache/background_styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f2961ef025e9598bbc17229d642d373a9eb7feaa927ac1149a1bfc546d31caed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blitarcab.dindik.jatimprov.go.id/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 01 Dec 2021 08:21:49 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 01 Dec 2021 09:38:48 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 01 Dec 2021 09:38:48 GMT

GET
H/1.1 200
OK bgr.jpg
blitarcab.dindik.jatimprov.go.id/.well-known/xvx/cache/ 244 KB
245 KB 753ms
326ms Image
image/jpeg 103.106.74.14
IDNIC-JATIM-AS-ID...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/cache/bgr.jpg
Requested by: Host: blitarcab.dindik.jatimprov.go.id
URL: https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/cache/background_styles.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 103.106.74.14 , Indonesia, ASN136884 (IDNIC-JATIM-AS-ID Dinas Komunikasi dan Informatika Provinsi jawa timur, ID),
Reverse DNS
Software: Apache /
Resource Hash: ae3ca3cd183c8dfe9acdf92751d544555cb50b5e2f3adfdd57edb1ba9a6250a4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/cache/background_styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 01 Dec 2021 09:38:49 GMT
Last-Modified: Wed, 21 Aug 2019 09:25:56 GMT
Server: Apache
Connection: close
Accept-Ranges: bytes
Content-Length: 250191
Content-Type: image/jpeg

GET
H/1.1 200
OK Technology-Bold.ttf
blitarcab.dindik.jatimprov.go.id/.well-known/xvx/cache/ 40 KB
41 KB 620ms
210ms Font
font/ttf 103.106.74.14
IDNIC-JATIM-AS-ID...

General

Check archive.org

Show headers Download Go to

Full URL: https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/cache/Technology-Bold.ttf
Requested by: Host: blitarcab.dindik.jatimprov.go.id
URL: https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/cache/background_styles.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 103.106.74.14 , Indonesia, ASN136884 (IDNIC-JATIM-AS-ID Dinas Komunikasi dan Informatika Provinsi jawa timur, ID),
Reverse DNS
Software: Apache /
Resource Hash: e0820a01e8be18589121c87e194a0f23f631ad9da45637c4719d218f5d124bf5

Request headers

Referer: https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/cache/background_styles.css
Origin: https://blitarcab.dindik.jatimprov.go.id
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 01 Dec 2021 09:38:49 GMT
Last-Modified: Tue, 18 Dec 2018 10:23:42 GMT
Server: Apache
Connection: close
Accept-Ranges: bytes
Content-Length: 41392
Content-Type: font/ttf

GET
H2 200 1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvaorCIPrE.woff2
fonts.gstatic.com/s/raleway/v22/ 21 KB
21 KB 31ms
8ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v22/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvaorCIPrE.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d94fd1a3793df0abe10fb36e59825864e1ec9623496e1e04c9cca624be01394

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://blitarcab.dindik.jatimprov.go.id
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 21:14:30 GMT
x-content-type-options: nosniff
age: 131058
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21028
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 19:40:20 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 29 Nov 2022 21:14:30 GMT

GET

nlkiu3sdvp3ztxj9dq1vqcxjro.php
blitarcab.dindik.jatimprov.go.id/.well-known/xvx/
Redirect Chain

https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/load.php?0=&guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV...
https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/nlkiu3sdvp3ztxj9dq1vqcxjro.php?0=&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjc...

0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: blitarcab.dindik.jatimprov.go.id
URL: https://blitarcab.dindik.jatimprov.go.id/.well-known/xvx/nlkiu3sdvp3ztxj9dq1vqcxjro.php?0=&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			blitarcab.dindik.jatimprov.go.id/	1969-12-31 23:59:59	Name: PHPSESSID Value: ebfe1b723ec06e7a8e25ea4a9b521899

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blitarcab.dindik.jatimprov.go.id
fonts.googleapis.com
fonts.gstatic.com
blitarcab.dindik.jatimprov.go.id
103.106.74.14
2a00:1450:4001:829::200a
2a00:1450:4001:82b::2003
1d94fd1a3793df0abe10fb36e59825864e1ec9623496e1e04c9cca624be01394
58151938b48f02077ac1809421826b735dfac46f13cb3e1494938447d99b604e
6257009114a4bb937f235be0a39293479ebdc719117d0e80480429f619ac04dd
92fd40762d767ac7711c39b19506d470d901d31c8ac193499b3b673ec1261396
ae3ca3cd183c8dfe9acdf92751d544555cb50b5e2f3adfdd57edb1ba9a6250a4
d6fc3d1520a00be1c8c8cb060a85bdb76f8daa6596e58d2b2a977ea67bb0a886
e0820a01e8be18589121c87e194a0f23f631ad9da45637c4719d218f5d124bf5
f2961ef025e9598bbc17229d642d373a9eb7feaa927ac1149a1bfc546d31caed

blitarcab.dindik.jatimprov.go.id Open in urlscan Pro 103.106.74.14 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

9 Requests

89 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

310 kBTransfer

309 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Indicators

blitarcab.dindik.jatimprov.go.id Open in urlscan Pro
103.106.74.14 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

89 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

310 kB
Transfer

309 kB
Size

1
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!