spn.sumut.polri.go.id Open in urlscan Pro
120.29.231.3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://strt.hm.rc.qvhabf.dgitc.ir/qzq/zqz/?s7bdKzlkwue
Effective URL:
https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255792af82878942709&sec...
Submission: On April 03 via manual (April 3rd 2024, 7:47:43 pm UTC) from GB — Scanned from GB

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 13 HTTP transactions. The main IP is 120.29.231.3, located in Indonesia and belongs to POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID. The main domain is spn.sumut.polri.go.id.
TLS certificate: Issued by cPanel, Inc. Certification Authority on February 6th 2024. Valid for: 3 months.

This is the only time spn.sumut.polri.go.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UK Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
2 2	158.58.187.76 158.58.187.76	57497 (FARASOSAM...) (FARASOSAMANEHPASARGAD)
1	42.112.30.39 42.112.30.39	18403 (FPT-AS-AP...) (FPT-AS-AP FPT Telecom Company)
1 12	120.29.231.3 120.29.231.3	38764 (POLRI-AS-...) (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA)
13	3

2 158.58.187.76 (Tehran, Iran, Islamic Republic Of) 2 redirects

ASN57497 (FARASOSAMANEHPASARGAD, IR)
PTR: cms600.hostnegar.com

strt.hm.rc.qvhabf.dgitc.ir	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 42.112.30.39 (Ho Chi Minh City, Viet Nam)

ASN18403 (FPT-AS-AP FPT Telecom Company, VN)
PTR: 3039.hostingviet.vn

hclub.vn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 120.29.231.3 (Indonesia) 1 redirects

ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID)
PTR: bidlabfor.sumut.polri.go.id

spn.sumut.polri.go.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	polri.go.id 1 redirects spn.sumut.polri.go.id	368 KB
2	dgitc.ir 2 redirects strt.hm.rc.qvhabf.dgitc.ir	622 B
1	hclub.vn hclub.vn	194 B
13	3

	Domain	Requested by
12	spn.sumut.polri.go.id	1 redirects spn.sumut.polri.go.id
2	strt.hm.rc.qvhabf.dgitc.ir	2 redirects
1	hclub.vn
13	3

This site contains no links.

Subject Issuer	Validity	Valid
hclub.vn R3	`2024-02-07` - `2024-05-07`	3 months	crt.sh
spn.sumut.polri.go.id cPanel, Inc. Certification Authority	`2024-02-06` - `2024-05-06`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true
Frame ID: 67781D58522981B22F76B604A1E9680B
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/?sessionid=6170c11818077255792af82878... HTTP 302
https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

92 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

532 kB
Transfer

1017 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/?sessionid=6170c11818077255792af82878942709&securessl=true HTTP 302
https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://strt.hm.rc.qvhabf.dgitc.ir/qzq/zqz/?s7bdKzlkwue HTTP 307
https://strt.hm.rc.qvhabf.dgitc.ir/qzq/zqz/?s7bdKzlkwue HTTP 302
https://hclub.vn/cgi/?sessionid=6170c11818077255792af82878942709&securessl=true HTTP 307
http://strt.hm.rc.qvhabf.dgitc.ir/qzq/zqz/?s7bdKzlkwue HTTP 302
https://hclub.vn/cgi/?sessionid=6170c11818077255792af82878942709&securessl=true

13 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response hclub.vn/cgi/ Redirect Chain http://strt.hm.rc.qvhabf.dgitc.ir/qzq/zqz/?s7bdKzlkwue https://strt.hm.rc.qvhabf.dgitc.ir/qzq/zqz/?s7bdKzlkwue https://hclub.vn/cgi/?sessionid=6170c11818077255792af82878942709&securessl=true http://strt.hm.rc.qvhabf.dgitc.ir/qzq/zqz/?s7bdKzlkwue https://hclub.vn/cgi/?sessionid=6170c11818077255792af82878942709&securessl=true	0 194 B	1532ms 1532ms	Document text/html	42.112.30.39 FPT-AS-AP FPT Tel...
General Check archive.org Show headers Download Go to Full URL https://hclub.vn/cgi/?sessionid=6170c11818077255792af82878942709&securessl=true Protocol H2 Security TLS 1.3, , AES_128_GCM Server 42.112.30.39 Ho Chi Minh City, Viet Nam, ASN18403 (FPT-AS-AP FPT Telecom Company, VN), Reverse DNS 3039.hostingviet.vn Software LiteSpeed / PHP/7.4.33 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers content-length 0 content-type text/html; charset=UTF-8 date Wed, 03 Apr 2024 19:47:36 GMT refresh 0; URL=https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/?sessionid=6170c11818077255792af82878942709&securessl=true server LiteSpeed x-powered-by PHP/7.4.33 Redirect headers Connection Keep-Alive Keep-Alive timeout=5, max=100 cache-control no-cache, no-store, must-revalidate, max-age=0 content-length 0 content-type text/html; charset=UTF-8 date Wed, 03 Apr 2024 19:47:34 GMT location https://hclub.vn/cgi/?sessionid=6170c11818077255792af82878942709&securessl=true
GET H/1.1	200 OK	Primary Request start.php Show response spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/ Redirect Chain https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/?sessionid=6170c11818077255792af82878942709&securessl=true https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true	9 KB 3 KB	1114ms 1114ms	Document text/html	120.29.231.3 POLRI-AS-ID MARKA...
General Check archive.org Show headers Download Go to Full URL https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID), Reverse DNS bidlabfor.sumut.polri.go.id Software Apache / Resource Hash `71b669b9fbf418876ed88236494c62a861fdf7fdfa108d4b230517c53da81ed5` Request headers Referer https://hclub.vn/cgi/?sessionid=6170c11818077255792af82878942709&securessl=true Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 accept-language en-GB,en;q=0.9 sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Content-Encoding br Content-Length 2693 Content-Type text/html; charset=UTF-8 Date Wed, 03 Apr 2024 19:47:39 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=99 Pragma no-cache Server Apache Vary Accept-Encoding Redirect headers Connection Keep-Alive Content-Encoding br Content-Length 1 Content-Type text/html; charset=UTF-8 Date Wed, 03 Apr 2024 19:47:37 GMT Keep-Alive timeout=5, max=100 Location start.php?&sessionid=6170c11818077255792af82878942709&securessl=true Server Apache Vary Accept-Encoding
GET H/1.1	200 OK	jquery.min.js Show response spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/	82 KB 28 KB	209ms 206ms	Script application/javascript	120.29.231.3 POLRI-AS-ID MARKA...
General Check archive.org Show headers Download Go to Full URL https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/jquery.min.js Requested by Host: spn.sumut.polri.go.id URL: https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID), Reverse DNS bidlabfor.sumut.polri.go.id Software Apache / Resource Hash `874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true accept-language en-GB,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 03 Apr 2024 19:47:40 GMT Content-Encoding br Last-Modified Thu, 30 Jul 2020 07:47:01 GMT Server Apache Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 28801
GET H/1.1	200 OK	govuk-template.css spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/	20 KB 4 KB	582ms 197ms	Stylesheet text/css	120.29.231.3 POLRI-AS-ID MARKA...
General Check archive.org Show headers Download Go to Full URL https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/govuk-template.css Requested by Host: spn.sumut.polri.go.id URL: https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID), Reverse DNS bidlabfor.sumut.polri.go.id Software Apache / Resource Hash `13aa82ee00bd9d59269c252d580447fd09dfcc71fbf7e0fe929d598c509bf79e` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true accept-language en-GB,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 03 Apr 2024 19:47:40 GMT Content-Encoding br Last-Modified Thu, 30 Jul 2020 07:47:01 GMT Server Apache Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 4086
GET H/1.1	200 OK	fonts.css spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/	267 KB 196 KB	828ms 383ms	Stylesheet text/css	120.29.231.3 POLRI-AS-ID MARKA...
General Check archive.org Show headers Download Go to Full URL https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/fonts.css Requested by Host: spn.sumut.polri.go.id URL: https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID), Reverse DNS bidlabfor.sumut.polri.go.id Software Apache / Resource Hash `6813a04aa7ebe09726eda5fdd9c4abf1c5f151335adf0ad90474a5fe316e87ed` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true accept-language en-GB,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 03 Apr 2024 19:47:41 GMT Content-Encoding br Last-Modified Thu, 30 Jul 2020 07:47:01 GMT Server Apache Vary Accept-Encoding Transfer-Encoding chunked Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100
GET H/1.1	200 OK	application.min.css spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/	178 KB 37 KB	828ms 384ms	Stylesheet text/css	120.29.231.3 POLRI-AS-ID MARKA...
General Check archive.org Show headers Download Go to Full URL https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/application.min.css Requested by Host: spn.sumut.polri.go.id URL: https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID), Reverse DNS bidlabfor.sumut.polri.go.id Software Apache / Resource Hash `ab3a0f463d776896fd738585a03a21c34f591f138df27815a0eda176fc42bad6` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true accept-language en-GB,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 03 Apr 2024 19:47:41 GMT Content-Encoding br Last-Modified Thu, 30 Jul 2020 07:47:01 GMT Server Apache Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 37787
GET H/1.1	200 OK	gov.uk_logotype_crown.png spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/	780 B 1022 B	821ms 364ms	Image image/png	120.29.231.3 POLRI-AS-ID MARKA...
General Check archive.org Show headers Download Go to Show image Full URL https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/gov.uk_logotype_crown.png Requested by Host: spn.sumut.polri.go.id URL: https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID), Reverse DNS bidlabfor.sumut.polri.go.id Software Apache / Resource Hash `14b98db97bbd6cb1f33935d3e0d973fa68ca0c38fb5762b033423ceffe9e16f6` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true accept-language en-GB,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 03 Apr 2024 19:47:41 GMT Last-Modified Thu, 30 Jul 2020 07:47:01 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 780
GET H/1.1	200 OK	open-government-licence_2x.png spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/	504 B 746 B	823ms 366ms	Image image/png	120.29.231.3 POLRI-AS-ID MARKA...
General Check archive.org Show headers Download Go to Show image Full URL https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/open-government-licence_2x.png Requested by Host: spn.sumut.polri.go.id URL: https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID), Reverse DNS bidlabfor.sumut.polri.go.id Software Apache / Resource Hash `2dcbca9026a39b5e4cc536b2f842bd173148b018c7ce369a5930558f4de0e23b` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true accept-language en-GB,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 03 Apr 2024 19:47:41 GMT Last-Modified Thu, 30 Jul 2020 07:47:01 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 504
GET H/1.1	200 OK	application.min.js Show response spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/	288 KB 91 KB	468ms 403ms	Script application/javascript	120.29.231.3 POLRI-AS-ID MARKA...
General Check archive.org Show headers Download Go to Full URL https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/application.min.js Requested by Host: spn.sumut.polri.go.id URL: https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID), Reverse DNS bidlabfor.sumut.polri.go.id Software Apache / Resource Hash `b1ba9b0ff9669b7ffd38f4c96d42441573db020edcd45d46f4468d76f1ccf40f` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true accept-language en-GB,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 03 Apr 2024 19:47:41 GMT Content-Encoding br Last-Modified Thu, 30 Jul 2020 07:47:01 GMT Server Apache Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 92438
GET H/1.1	200 OK	govuk-template-print.css spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/	1 KB 848 B	196ms 195ms	Stylesheet text/css	120.29.231.3 POLRI-AS-ID MARKA...
General Check archive.org Show headers Download Go to Full URL https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/govuk-template-print.css Requested by Host: spn.sumut.polri.go.id URL: https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID), Reverse DNS bidlabfor.sumut.polri.go.id Software Apache / Resource Hash `5bb990686d6668df3f9d5208b10fa83d2f5d55820b442be13542a3dfbd3e361a` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/start.php?&sessionid=6170c11818077255792af82878942709&securessl=true accept-language en-GB,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 03 Apr 2024 19:47:41 GMT Content-Encoding br Last-Modified Thu, 30 Jul 2020 07:47:01 GMT Server Apache Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 563
GET H/1.1	200 OK	hmrc_crest_18px.png spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/	2 KB 2 KB	195ms 194ms	Image image/png	120.29.231.3 POLRI-AS-ID MARKA...
General Check archive.org Show headers Download Go to Show image Full URL https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/hmrc_crest_18px.png Requested by Host: spn.sumut.polri.go.id URL: https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/application.min.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID), Reverse DNS bidlabfor.sumut.polri.go.id Software Apache / Resource Hash `c208f82493fb15f9261ba474cf6615ddc22e51984177095c4d12d2ad39647ca9` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/application.min.css accept-language en-GB,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 03 Apr 2024 19:47:41 GMT Last-Modified Thu, 30 Jul 2020 07:47:01 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1637
GET H/1.1	200 OK	govuk-crest.png spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/	4 KB 4 KB	194ms 194ms	Image image/png	120.29.231.3 POLRI-AS-ID MARKA...
General Check archive.org Show headers Download Go to Show image Full URL https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/govuk-crest.png Requested by Host: spn.sumut.polri.go.id URL: https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/govuk-template.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 120.29.231.3 , Indonesia, ASN38764 (POLRI-AS-ID MARKAS BESAR KEPOLISIAN REPUBLIK INDONESIA, ID), Reverse DNS bidlabfor.sumut.polri.go.id Software Apache / Resource Hash `bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/govuk-template.css accept-language en-GB,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 03 Apr 2024 19:47:41 GMT Last-Modified Thu, 30 Jul 2020 07:47:01 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 3584
GET DATA	200 OK	truncated /	94 KB 94 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30` Request headers Referer Origin https://spn.sumut.polri.go.id accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	71 KB 71 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba` Request headers Referer Origin https://spn.sumut.polri.go.id accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Response headers Content-Type application/font-woff
GET		favicon.ico spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: spn.sumut.polri.go.id
URL: https://spn.sumut.polri.go.id/.well-known/ssl/tmp/home/ssl/horde/pki/step1_files/favicon.ico

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UK Government (Government)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			spn.sumut.polri.go.id/	1969-12-31 23:59:59	Name: PHPSESSID Value: vmr1spkqvnsc5bcjnjkq30fqs1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

hclub.vn
spn.sumut.polri.go.id
strt.hm.rc.qvhabf.dgitc.ir
spn.sumut.polri.go.id
120.29.231.3
158.58.187.76
42.112.30.39
01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba
048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30
13aa82ee00bd9d59269c252d580447fd09dfcc71fbf7e0fe929d598c509bf79e
14b98db97bbd6cb1f33935d3e0d973fa68ca0c38fb5762b033423ceffe9e16f6
2dcbca9026a39b5e4cc536b2f842bd173148b018c7ce369a5930558f4de0e23b
5bb990686d6668df3f9d5208b10fa83d2f5d55820b442be13542a3dfbd3e361a
6813a04aa7ebe09726eda5fdd9c4abf1c5f151335adf0ad90474a5fe316e87ed
71b669b9fbf418876ed88236494c62a861fdf7fdfa108d4b230517c53da81ed5
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4
ab3a0f463d776896fd738585a03a21c34f591f138df27815a0eda176fc42bad6
b1ba9b0ff9669b7ffd38f4c96d42441573db020edcd45d46f4468d76f1ccf40f
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b
c208f82493fb15f9261ba474cf6615ddc22e51984177095c4d12d2ad39647ca9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

spn.sumut.polri.go.id Open in urlscan Pro 120.29.231.3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

92 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

532 kBTransfer

1017 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Indicators

spn.sumut.polri.go.id Open in urlscan Pro
120.29.231.3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

92 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

532 kB
Transfer

1017 kB
Size

1
Cookies

13 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!