alumni.stie-gema.ac.id

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 7 HTTP transactions. The main IP is 103.229.72.84, located in Jakarta, Indonesia and belongs to MWN-AS-ID PT Master Web Network, ID. The main domain is alumni.stie-gema.ac.id.

This is the only time alumni.stie-gema.ac.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Adobe (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
4	103.229.72.84 103.229.72.84	55660 (MWN-AS-ID...) (MWN-AS-ID PT Master Web Network)
1	130.211.160.56 130.211.160.56	15169 (GOOGLE) (GOOGLE - Google LLC)
2 3	64.130.23.5 64.130.23.5	7859 (PAIR-NETW...) (PAIR-NETWORKS - pair Networks)
1	172.217.16.174 172.217.16.174	15169 (GOOGLE) (GOOGLE - Google LLC)
7	4

4 103.229.72.84 (Jakarta, Indonesia)

ASN55660 (MWN-AS-ID PT Master Web Network, ID)
PTR: cl450107x.i.maintenis.com

alumni.stie-gema.ac.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 130.211.160.56 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 56.160.211.130.bc.googleusercontent.com

www.muslimadvocates.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 64.130.23.5 (Pittsburgh, United States) 2 redirects

ASN7859 (PAIR-NETWORKS - pair Networks, US)
PTR: bountifulbreast.co.uk

www.bountifulbreast.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bountifulbreast.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.16.174 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s11-in-f174.1e100.net

encrypted-tbn1.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	stie-gema.ac.id alumni.stie-gema.ac.id	17 KB
3	bountifulbreast.co.uk 2 redirects www.bountifulbreast.co.uk bountifulbreast.co.uk	17 KB
1	gstatic.com encrypted-tbn1.gstatic.com	10 KB
1	muslimadvocates.org www.muslimadvocates.org	11 KB
7	4

	Domain	Requested by
4	alumni.stie-gema.ac.id	alumni.stie-gema.ac.id
2	www.bountifulbreast.co.uk	2 redirects
1	encrypted-tbn1.gstatic.com	alumni.stie-gema.ac.id
1	bountifulbreast.co.uk	alumni.stie-gema.ac.id
1	www.muslimadvocates.org	alumni.stie-gema.ac.id
7	5

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/login.php?login=zhannura-89%40mail.ru
Frame ID: 73745A23E1CEBC93B5C71D56BE085FCD
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

7
Requests

0 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

54 kB
Transfer

37 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

http://www.bountifulbreast.co.uk/images/100Secure.jpg HTTP 301
https://www.bountifulbreast.co.uk/images/100Secure.jpg HTTP 301
https://bountifulbreast.co.uk/images/100Secure.jpg

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request login.php Show response
alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/ 16 KB
16 KB 376ms
204ms Document
text/html 103.229.72.84
MWN-AS-ID PT Mast...

General

Check archive.org

Show headers Download Go to

Full URL: http://alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/login.php?login=zhannura-89%40mail.ru
Protocol: HTTP/1.1
Server: 103.229.72.84 Jakarta, Indonesia, ASN55660 (MWN-AS-ID PT Master Web Network, ID),
Reverse DNS: cl450107x.i.maintenis.com
Software: Apache /
Resource Hash: 21331233c2a5654ec5b6247ef3fc09ae99e1f2f303b2fe5df22e5fdd55c84f09

Request headers

Host: alumni.stie-gema.ac.id
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 73745A23E1CEBC93B5C71D56BE085FCD

Response headers

Date: Thu, 07 Jun 2018 00:27:15 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
S 200 pdf-logo-112x113.png
www.muslimadvocates.org/wp-content/uploads/ 11 KB
11 KB 499ms
235ms Image
image/png 130.211.160.56
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.muslimadvocates.org/wp-content/uploads/pdf-logo-112x113.png
Requested by: Host: alumni.stie-gema.ac.id
URL: http://alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/login.php?login=zhannura-89%40mail.ru
Protocol: SPDY
Server: 130.211.160.56 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 56.160.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 0c5737447893aecf29c1c75919905a3d7abb79d87ffaad617edd48be7c8408b5

Request headers

Referer: http://alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/login.php?login=zhannura-89%40mail.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-type: static/known
date: Thu, 07 Jun 2018 00:27:19 GMT
last-modified: Tue, 06 Sep 2016 18:19:22 GMT
server: nginx
status: 200
etag: "57cf08aa-2a48"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 10824

GET
H/1.1

404
Not Found

100Secure.jpg
bountifulbreast.co.uk/images/
Redirect Chain

http://www.bountifulbreast.co.uk/images/100Secure.jpg
https://www.bountifulbreast.co.uk/images/100Secure.jpg
https://bountifulbreast.co.uk/images/100Secure.jpg

0
16 KB

698ms
353ms

Image
text/html

64.130.23.5
pair Networks

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bountifulbreast.co.uk/images/100Secure.jpg
Requested by: Host: alumni.stie-gema.ac.id
URL: http://alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/login.php?login=zhannura-89%40mail.ru
Protocol: HTTP/1.1
Server: 64.130.23.5 Pittsburgh, United States, ASN7859 (PAIR-NETWORKS - pair Networks, US),
Reverse DNS: bountifulbreast.co.uk
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/login.php?login=zhannura-89%40mail.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Thu, 07 Jun 2018 00:27:20 GMT
Server: Apache/2.4.33
Vary: Cookie
Content-Type: text/html; charset=UTF-8
Location: https://bountifulbreast.co.uk/images/100Secure.jpg
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 0
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
S 200 images
encrypted-tbn1.gstatic.com/ 9 KB
10 KB 48ms
13ms Image
image/jpeg 172.217.16.174
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn1.gstatic.com/images?q=tbn:ANd9GcS831wv1vSuKhjjeRoW-w-C3BA7OMye3Tkcx1VCX5uXPuErsIRE

Requested by

Host: alumni.stie-gema.ac.id
URL: http://alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/login.php?login=zhannura-89%40mail.ru

Protocol

SPDY

Server

172.217.16.174 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f174.1e100.net

Software

sffe /

Resource Hash

76a5786df27f7a3a8008ec8881bc9c98abec350cdb157e61990583c52534f98b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/login.php?login=zhannura-89%40mail.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 07 Jun 2018 00:27:19 GMT
x-content-type-options: nosniff
last-modified: Thu, 30 Jun 2016 18:16:23 GMT
server: sffe
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 9541
x-xss-protection: 1; mode=block
expires: Fri, 07 Jun 2019 00:27:19 GMT

GET
H/1.1 500
Internal Server Error small.png
alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/Files/ 676 B
676 B 345ms
173ms Image
text/html 103.229.72.84
MWN-AS-ID PT Mast...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/Files/small.png
Requested by: Host: alumni.stie-gema.ac.id
URL: http://alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/login.php?login=zhannura-89%40mail.ru
Protocol: HTTP/1.1
Server: 103.229.72.84 Jakarta, Indonesia, ASN55660 (MWN-AS-ID PT Master Web Network, ID),
Reverse DNS: cl450107x.i.maintenis.com
Software: Apache /
Resource Hash: 4131d65488c07b5e588fba9a0e4ef4728f559957baf71324c8110c62cb98b114

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: alumni.stie-gema.ac.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/login.php?login=zhannura-89%40mail.ru
Connection: keep-alive
Cache-Control: no-cache
Referer: http://alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/login.php?login=zhannura-89%40mail.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 07 Jun 2018 00:27:16 GMT
Server: Apache
Connection: close
Content-Length: 676
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 500
Internal Server Error et-line.woff
alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/fonts/ 0
0 336ms
172ms Font
text/html 103.229.72.84
MWN-AS-ID PT Mast...

General

Check archive.org

Show headers Download Go to

Full URL: http://alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/fonts/et-line.woff
Requested by: Host: alumni.stie-gema.ac.id
URL: http://alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/login.php?login=zhannura-89%40mail.ru
Protocol: HTTP/1.1
Server: 103.229.72.84 Jakarta, Indonesia, ASN55660 (MWN-AS-ID PT Master Web Network, ID),
Reverse DNS: cl450107x.i.maintenis.com
Software: Apache /
Resource Hash

Request headers

Pragma: no-cache
Origin: http://alumni.stie-gema.ac.id
Accept-Encoding: gzip, deflate
Host: alumni.stie-gema.ac.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: */*
Referer: http://alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/login.php?login=zhannura-89%40mail.ru
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer: http://alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/login.php?login=zhannura-89%40mail.ru
Origin: http://alumni.stie-gema.ac.id

Response headers

Date: Thu, 07 Jun 2018 00:27:16 GMT
Server: Apache
Connection: close
Content-Length: 676
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 500
Internal Server Error et-line.ttf
alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/fonts/ 0
0 173ms
173ms Font
text/html 103.229.72.84
MWN-AS-ID PT Mast...

General

Check archive.org

Show headers Download Go to

Full URL: http://alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/fonts/et-line.ttf
Requested by: Host: alumni.stie-gema.ac.id
URL: http://alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/login.php?login=zhannura-89%40mail.ru
Protocol: HTTP/1.1
Server: 103.229.72.84 Jakarta, Indonesia, ASN55660 (MWN-AS-ID PT Master Web Network, ID),
Reverse DNS: cl450107x.i.maintenis.com
Software: Apache /
Resource Hash

Request headers

Pragma: no-cache
Origin: http://alumni.stie-gema.ac.id
Accept-Encoding: gzip, deflate
Host: alumni.stie-gema.ac.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: */*
Referer: http://alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/login.php?login=zhannura-89%40mail.ru
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer: http://alumni.stie-gema.ac.id/wp-content/plugins/snooppdf/login.php?login=zhannura-89%40mail.ru
Origin: http://alumni.stie-gema.ac.id

Response headers

Date: Thu, 07 Jun 2018 00:27:16 GMT
Server: Apache
Connection: close
Content-Length: 676
Content-Type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Adobe (Consumer)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| check function| validateForm

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

alumni.stie-gema.ac.id
bountifulbreast.co.uk
encrypted-tbn1.gstatic.com
www.bountifulbreast.co.uk
www.muslimadvocates.org
103.229.72.84
130.211.160.56
172.217.16.174
64.130.23.5
0c5737447893aecf29c1c75919905a3d7abb79d87ffaad617edd48be7c8408b5
21331233c2a5654ec5b6247ef3fc09ae99e1f2f303b2fe5df22e5fdd55c84f09
4131d65488c07b5e588fba9a0e4ef4728f559957baf71324c8110c62cb98b114
76a5786df27f7a3a8008ec8881bc9c98abec350cdb157e61990583c52534f98b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

alumni.stie-gema.ac.id Open in urlscan Pro 103.229.72.84 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

7 Requests

0 %HTTPS

0 %IPv6

4 Domains

5 Subdomains

4 IPs

2 Countries

54 kBTransfer

37 kBSize

0 Cookies

0 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

alumni.stie-gema.ac.id Open in urlscan Pro
103.229.72.84 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

0 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

54 kB
Transfer

37 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!