urlscan.io logo urlscan.io
SecurityTrails logo

batualamraya.com Open in urlscan Pro
103.252.100.58  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
Submission: On September 22 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 103.252.100.58, located in Indonesia and belongs to IDNIC-DRUPADI-AS-ID PT. Drupadi Prima, ID. The main domain is batualamraya.com.
This is the only time batualamraya.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

IP Address AS Autonomous System
8 103.252.100.58 59147 (IDNIC-DRU...)
1 2.20.22.134 20940 (AKAMAI-ASN1)
9 2
Apex Domain
Subdomains		 Transfer
8 batualamraya.com
batualamraya.com
89 KB
1 paypalobjects.com
www.paypalobjects.com
2 KB
9 2
Domain Requested by
8 batualamraya.com batualamraya.com
1 www.paypalobjects.com batualamraya.com
9 2

This site contains no links.

Subject Issuer Validity Valid
www.paypal.com
DigiCert SHA2 Extended Validation Server CA		 2018-08-14 -
2020-08-18		 2 years crt.sh

This page contains 1 frames:

Primary Page: http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
Frame ID: 1441464CFC9E215156B2967820DF1DAC
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /^LiteSpeed$/i
Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js/i
  • env /^jQuery$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i

Page Statistics

9
Requests

11 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

91 kB
Transfer

314 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set signin.php
batualamraya.com/account/Access/g3hVy/ 		5 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
Protocol
HTTP/1.1
Server
103.252.100.58 , Indonesia, ASN59147 (IDNIC-DRUPADI-AS-ID PT. Drupadi Prima, ID),
Reverse DNS
iix01.whmbox.com
Software
LiteSpeed / PHP/5.6.36
Resource Hash
892dbda72099aa196ec57b9908da69ceba202495a252d15c35abde37427099f8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Host
batualamraya.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Powered-By
PHP/5.6.36
Set-Cookie
PHPSESSID=f309cd72104f0ad0c6459b20e64bed96; path=/
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Content-Type
text/html; charset=UTF-8
Content-Length
3693
Content-Encoding
gzip
Vary
Accept-Encoding
Date
Sat, 22 Sep 2018 14:54:55 GMT
Accept-Ranges
bytes
Server
LiteSpeed
X-Content-Type-Options
nosniff
Connection
Keep-Alive
crypt.js
batualamraya.com/account/Access/assets/js/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://batualamraya.com/account/Access/assets/js/crypt.js
Requested by
Host: batualamraya.com
URL: http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
Protocol
HTTP/1.1
Server
103.252.100.58 , Indonesia, ASN59147 (IDNIC-DRUPADI-AS-ID PT. Drupadi Prima, ID),
Reverse DNS
iix01.whmbox.com
Software
LiteSpeed /
Resource Hash
75229eb0a3642ec7b99af3af2002d56c2546a1e2bea777c93c46b166211e6756
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
batualamraya.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
Cookie
PHPSESSID=f309cd72104f0ad0c6459b20e64bed96
Connection
keep-alive
Cache-Control
no-cache
Referer
http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 22 Sep 2018 14:54:56 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sat, 22 Sep 2018 12:53:20 GMT
Server
LiteSpeed
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
6896
Expires
Sat, 29 Sep 2018 14:54:56 GMT
signin.css
batualamraya.com/account/Access/assets/css/ 		41 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://batualamraya.com/account/Access/assets/css/signin.css
Requested by
Host: batualamraya.com
URL: http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
Protocol
HTTP/1.1
Server
103.252.100.58 , Indonesia, ASN59147 (IDNIC-DRUPADI-AS-ID PT. Drupadi Prima, ID),
Reverse DNS
iix01.whmbox.com
Software
LiteSpeed /
Resource Hash
e04e3838790a0e10927adbbf6086dc1b8fdf239058c7551c086af1fee19cb6e6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
batualamraya.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
Cookie
PHPSESSID=f309cd72104f0ad0c6459b20e64bed96
Connection
keep-alive
Cache-Control
no-cache
Referer
http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 22 Sep 2018 14:54:56 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sat, 22 Sep 2018 12:53:20 GMT
Server
LiteSpeed
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
9992
Expires
Sat, 29 Sep 2018 14:54:56 GMT
bootstrap.min.css
batualamraya.com/account/Access/assets/css/ 		147 KB
27 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://batualamraya.com/account/Access/assets/css/bootstrap.min.css
Requested by
Host: batualamraya.com
URL: http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
Protocol
HTTP/1.1
Server
103.252.100.58 , Indonesia, ASN59147 (IDNIC-DRUPADI-AS-ID PT. Drupadi Prima, ID),
Reverse DNS
iix01.whmbox.com
Software
LiteSpeed /
Resource Hash
210845361f7886c5400c7656db0196bb22c27a283f7ffca08f5e6e471001884c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
batualamraya.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
Cookie
PHPSESSID=f309cd72104f0ad0c6459b20e64bed96
Connection
keep-alive
Cache-Control
no-cache
Referer
http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 22 Sep 2018 14:54:56 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sat, 22 Sep 2018 12:53:20 GMT
Server
LiteSpeed
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
27689
Expires
Sat, 29 Sep 2018 14:54:56 GMT
jquery.min.js
batualamraya.com/account/Access/assets/js/ 		95 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://batualamraya.com/account/Access/assets/js/jquery.min.js
Requested by
Host: batualamraya.com
URL: http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
Protocol
HTTP/1.1
Server
103.252.100.58 , Indonesia, ASN59147 (IDNIC-DRUPADI-AS-ID PT. Drupadi Prima, ID),
Reverse DNS
iix01.whmbox.com
Software
LiteSpeed /
Resource Hash
ed0206f3256580b4c5adc28086a186034943d01b0c811909a4ad34dd9c42e98b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
batualamraya.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
Cookie
PHPSESSID=f309cd72104f0ad0c6459b20e64bed96
Connection
keep-alive
Cache-Control
no-cache
Referer
http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 22 Sep 2018 14:54:56 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sat, 22 Sep 2018 12:53:20 GMT
Server
LiteSpeed
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
39806
Expires
Sat, 29 Sep 2018 14:54:56 GMT
custom.js
batualamraya.com/account/Access/assets/js/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://batualamraya.com/account/Access/assets/js/custom.js
Requested by
Host: batualamraya.com
URL: http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
Protocol
HTTP/1.1
Server
103.252.100.58 , Indonesia, ASN59147 (IDNIC-DRUPADI-AS-ID PT. Drupadi Prima, ID),
Reverse DNS
iix01.whmbox.com
Software
LiteSpeed / PHP/5.6.36
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
batualamraya.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
Cookie
PHPSESSID=f309cd72104f0ad0c6459b20e64bed96
Connection
keep-alive
Cache-Control
no-cache
Referer
http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 22 Sep 2018 14:54:56 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
LiteSpeed
X-Powered-By
PHP/5.6.36
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
129
signin.js
batualamraya.com/account/Access/assets/ 		1 KB
803 B 		Script
General
Check archive.org
Download Go to
Full URL
http://batualamraya.com/account/Access/assets/signin.js
Requested by
Host: batualamraya.com
URL: http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
Protocol
HTTP/1.1
Server
103.252.100.58 , Indonesia, ASN59147 (IDNIC-DRUPADI-AS-ID PT. Drupadi Prima, ID),
Reverse DNS
iix01.whmbox.com
Software
LiteSpeed /
Resource Hash
e657dbdc4946f7ade8d1d093ca3e39978c9456f54b3056a1e02e7c1a89147fa4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
batualamraya.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
Cookie
PHPSESSID=f309cd72104f0ad0c6459b20e64bed96
Connection
keep-alive
Cache-Control
no-cache
Referer
http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 22 Sep 2018 14:54:56 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sat, 22 Sep 2018 12:53:20 GMT
Server
LiteSpeed
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
418
Expires
Sat, 29 Sep 2018 14:54:56 GMT
custom.js
batualamraya.com/account/Access/assets/js/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://batualamraya.com/account/Access/assets/js/custom.js
Requested by
Host: batualamraya.com
URL: http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
Protocol
HTTP/1.1
Server
103.252.100.58 , Indonesia, ASN59147 (IDNIC-DRUPADI-AS-ID PT. Drupadi Prima, ID),
Reverse DNS
iix01.whmbox.com
Software
LiteSpeed / PHP/5.6.36
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
batualamraya.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
Cookie
PHPSESSID=f309cd72104f0ad0c6459b20e64bed96
Connection
keep-alive
Cache-Control
no-cache
Referer
http://batualamraya.com/account/Access/g3hVy/signin.php?locale.x=en&_token=MTUzNzYyMTIwOQ==
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 22 Sep 2018 14:54:57 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
LiteSpeed
X-Powered-By
PHP/5.6.36
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
129
paypal-logo-129x32.svg
www.paypalobjects.com/images/shared/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.paypalobjects.com/images/shared/paypal-logo-129x32.svg
Requested by
Host: batualamraya.com
URL: http://batualamraya.com/account/Access/assets/js/jquery.min.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2.20.22.134 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-20-22-134.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
http://batualamraya.com/account/Access/assets/css/signin.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Sat, 22 Sep 2018 14:55:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 24 Oct 2014 22:52:57 GMT
server
Apache
status
200
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
1929
expires
Mon, 22 Oct 2018 14:55:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| Aes object| Base64 object| Utf8 string| V2 string| Viper string| output string| ctrTxt function| $ function| jQuery

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff