You are receiving this message as we have found you as the official contact address or representative of one of the following: Cloudflare (https://cloudflare.com/), as we found the suspected site uses Cloudflare's website protection service,NOBU National Bank (https://www.nobubank.com/), as we found payment details linked to the bank,Pos Indonesia (https://posindonesia.co.id/), to notify on a recent phishing attack claiming on behalf of the company,Representative(s) of Ministry of Communication and Informatics, Republic of Indonesia (https://kominfo.go.id/) who are taking part in SMS and internet regulations,Operators of the s.id URL shortening service (https://s.id/), as the phishing actor uses their service to shorten the offending URL(s), andWebnic (https://www.webnic.cc/), as the domain registrar of the suspected site. We have recently found a lucky draw phishing attempt which uses your service and/or intellectual properties which claims on behalf of Pos Indonesia, the Indonesian state-owned post office and delivery service. The suspected site is located on https://posgiroindonesia.com/, which was registered through Webnic on March 12th, 2022, 01:48:36 UTC as found on the domain's WHOIS entry: Domain Name: posgiroindonesia.com Registry Domain ID: 2681013274_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.webnic.cc Registrar URL: webnic.cc Updated Date: 2022-03-12T01:50:04Z Creation Date: 2022-03-12T01:48:36Z Expiration Date: 2023-03-12T01:48:36Z Registrar: WEBCC Registrar IANA ID: 460 Registrar Abuse Contact Email: [email protected] Registrar Abuse Contact Phone: +60.389966799 Domain Status: ok https://icann.org/epp#ok Registry Registrant ID: Not Available From Registry Registrant Name: Domain Admin Registrant Organization: Whoisprotection.cc Registrant Street: L4-E-2, Level 4, Enterprise 4, Technology Park Malaysia, Bukit Jalil Registrant City: Kuala Lumpur Registrant State/Province: Wilayah Persekutuan Registrant Postal Code: 57000 Registrant Country: Malaysia Registrant Phone: +60.389966788 Registrant Phone Ext: Registrant Fax: +603.89966788 Registrant Fax Ext: Registrant Email: [email protected] Registry Admin ID: Not Available From Registry Admin Name: Domain Admin Admin Organization: Whoisprotection.cc Admin Street: L4-E-2, Level 4, Enterprise 4, Technology Park Malaysia, Bukit Jalil Admin City: Kuala Lumpur Admin State/Province: Wilayah Persekutuan Admin Postal Code: 57000 Admin Country: Malaysia Admin Phone: +60.389966788 Admin Phone Ext: Admin Fax: +603.89966788 Admin Fax Ext: Admin Email: [email protected] Registry Tech ID: Not Available From Registry Tech Name: Domain Admin Tech Organization: Whoisprotection.cc Tech Street: L4-E-2, Level 4, Enterprise 4, Technology Park Malaysia, Bukit Jalil Tech City: Kuala Lumpur Tech State/Province: Wilayah Persekutuan Tech Postal Code: 57000 Tech Country: Malaysia Tech Phone: +60.389966788 Tech Phone Ext: Tech Fax: +603.89966788 Tech Fax Ext: Tech Email: [email protected] Name Server: DOM.NS.CLOUDFLARE.COM Name Server: TERESA.NS.CLOUDFLARE.COM DNSSEC: unsigned URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/ >>> Last update of WHOIS database: 2022-03-12T01:50:04Z <<< The site uses Cloudflare and a WHOIS protection service to protect their website and related identities. Here, visiting https://posgiroindonesia.com/ directly will simply redirect the user to https://posindonesia.co.id/, the official website of Pos Indonesia. However, visiting the suspected URL with a special random ID will redirect the user into a special website, such as https://posgiroindonesia.com/cf62....e5b7. The original webpage consists the victim's name, mobile number, as well as home address. This is why we decided to redact these information (including the original, offending URL) when publishing this report to our official website at https://reinhart1010.id/. The phishing website is powered by Laravel, a PHP-based web development framework, which further suggests that the site is being hosted on a LAMP (Linux-Apache-MySQL/MariaDB-PHP)-based web server. However, we could not identify the web hosting provider of this website as the site is being protected by Cloudflare. In technical terms, performing a WHOIS entry lookup on each of IP addresses linked to the posgiroindonesia.com's DNS entry will simply return a list of Cloudflare-managed servers, instead of the original web server which runs the website. When pressing the "Claim" button shown on the above screenshot, the site performs a HTTP POST request to return a valid QR code for use in QRIS, the national QR-based payment system which is based on EMVCo's QR Code Specification for Payment Systems. Here, understanding the EMVCo's specification for merchant-presented payment QR codes is crucial to identify the threat actor. The above QR code contains the following payload: 00020101021226670016COM.NOBUBANK.WWW01189360050300000839560214531186424655810303UME51440014ID.CO.QRIS.WWW0215ID20221563643500303UME5204549953033605409251990.005802ID5903MRS6015JAKARTA SELATAN61051221062770114031300054398220525c6bf0ed4fb2cec5f40ed066cd061920220313165000231530703A016304EFF2 Which suggests that: The QR code declares itself as a dynamic payment QR code ("QRIS Dinamis"), which are more commonly used in payment gateways, EDC machines, and SaaS-based POS systems rather than a static QR code ("QRIS Statis") which is commonly printed as stickers in brochures and shops.The QR code was created on behalf of "MRS" instead of "Pos Indonesia", which is intentional to avoid rejection by Indonesian banks, digital wallets, and payment providers who are eligible to issue new QRIS payment QR codes.The National Merchant ID (NMID) of the suspected scammer's merchant is ID2022156364350.The merchant falls under the "Convenience and Specialty Stores" (5499) category, according to the QR's metadata. Similarly, we also have a valid static QRIS code (pictured below) which also falls under this exact category, despite declaring ourselves as a "Software house and SaaS provider" when requesting one from our QRIS issuer. Our official QRIS QR code. Original payload: 00020101021126680016ID.CO.TELKOM.WWW011893600898029003487302150001952900348730303UMI51440014ID.CO.QRIS.WWW0215ID10221477541080303UMI5204549953033605502015802ID5925REINHART PREVIANO KOENTJO6015KOTA JAKARTA PU61051026062220511100027433310703A1763040D45 The QR code was issued by neither any Indonesian state-owned banks (BNI, BRI, BTN, Bank Mandiri) nor Pospay, a digital wallet service owned by Pos Indonesia itself.Instead, the QR code was issued by NOBU National Bank, a privately-owned Indonesian bank, with the internal merchant PAN of 936005030000083956 and internal merchant ID of 53118642465581.Since the QR code was created dynamically (see Point 1) and issued by NOBU (see Point 6), we can highly assume that the scammer abuses NOBU's online payment gateway system to generate dynamic QRIS payment codes for phishing and scamming purposes. Note that we cannot further identify the scammer beyond this point. However, it is fairly easy for NOBU and legal authorities to further investigate and capture these scammers, as valid Indonesian IDs are still required to request new QRIS codes from authorized issuers, which can be found on https://www.aspi-indonesia.or.id/standar-dan-layanan/qris/. Here, we decided to notify related parties in the following order to help legal authorities validate this issue before revoking access to both QRIS merchant account and the suspected website. NOBU National Bank and Pos Indonesias.id URL shortening service and Ministry of Communication and Informatics of Republic of IndonesiaCloudflare and Webnic We value your cooperation in resolving this issue. In fact, we know that most of our contacted parties are still actively fighting online scams from Indonesia and all around the world. We understand that this type of scam is fairly new, hence stopping this scam website in the first place marks a great start in stopping future QRIS-based online scams. IMPORTANT NOTE: If you are voluntarily reading this from Indonesia, please do not give donations directly to our own QRIS payment code as shown on this blog post. Instead, you may support us through a number of ways, including sites such as Saweria and Trakteer which also supports payments from e-wallets and QRIS. Update 1: March 15, 2022 We forwarded the issue to NOBU National Bank via their official WhatsApp account. However, the bank rejected our report for not submitting transaction evidences with the scammer. The bank expects users to report scams after they're being scammed, or in their own terms, "experiencing financial losses". Meanwhile, the website was experiencing 500: Internal Server Error. The site is broken, I guess. But we decided to forward this issue to Cloudflare and Google Safe Browsing as well. Update 2: March 18, 2022 We're still curious enough to check whether the scam site is still working. Our Cloudflare and Google Safe Browsing reports didn't have any effects, though. However, what's changing here is that the "Claim" button redirects to a checkout page generated by Xendit, a Southeast Asia payment gateway, in case you're already familiar with Square and Stripe. This time, the merchant claimed to be "POSGIRO" instead of "MRS". The original invoice URL is https://checkout.xendit.co/web/6234b85f9820c061fbb94cfd. What a real Pos Indonesia checkout page look like? Some people also asked us whether there are clear examples of Pos Indonesia's real checkout page. Fortunately, we have one answer, on va.posindonesia.co.id, right when we receive an import tax bill to get our Hacktoberfest 2021 prizes mailed to our home address.* Here's another QRIS for you to analyze: The original payload here is: 00020101021226740022ID.CO.POSINDONESIA.WWW01189360816100000060050215ID20211150768080303PSO5204931153033605405675005802ID5917POS_INTERNASIONAL6007BANDUNG61054011562220703A010111500707128306304AB3B Which clearly states that this is a dynamic payment QR code ("QRIS Dinamis") issued right from Pos Indonesia! At least for their own postal and delivery services as well as Pospay merchants out there.

Semester 5 telah menjadi salah satu masa tersulit dalam perkuliahan saya. Dimulai dengan mental breakdown, lalu akhirnya bisa part-time rutin. Salah satu teman lama saya akhirnya masuk LINE TODAY, saya serah-terima jabatan manajer Web Development di HIMTI BINUS ke adik tingkat, sebelum gelisah masalah Enrichment Program saya, berurusan dengan kelompok-kelompok bermasalah dan akhirnya positif COVID-19. Semester 5 ini juga menjadi momen di mana saya berhasil membuat beberapa mahasiswa bertobat. Ya, bertobat dari mindset bahwa "saya cuman perlu untuk mengikuti materi-materi kelas saja", karena di dunia kerja kenyataannya tak begitu. Salah satu teman saya menceritakan pengalaman bahwa proses wawancara untuk magang (sebagai bagian dari Enrichment Program / 3+1 BINUS University) cukup menantang karena sang pewawancara menanyakan tentang keahliannya dalam Git, sesuatu yang sama sekali tidak diajarkan di dalam mata kuliah apapun di dalam program studi Teknik Informatika di BINUS. Ironisnya, saya telah mengadvokasi mahasiswa Teknik Informatika untuk "belajar di luar kelas", misalnya Git dan Python, bahkan sejak masa orientasi mahasiswa. Sekedar informasi, tugas-tugas part-time saya ini juga cukup campur aduk, dari bikin aplikasi Next.js ke server Python/Flask dan kini ke Dart/Flutter. Semua ini saya pelajari tanpa mengikuti materi-materi dari mata kuliah yang ada. Dan Semester 5 juga merupakan akhir penderitaan saya dari dua "penyakit" utama yang sering ada di dalam tugas kelompok: Anggota kelompok yang tidak aktif dan malah ghosting"Saya cuman ngikutin materi dari BINUS", karena itu saya cukup kecewa kelompok kita tidak bisa selangkah lebih depan daripada kelompok-kelompok lain. Penderitaan saya lebih berat daripada kamu, nak. Hari terakhir Ujian Akhir Semester, saya juga dikagetkan sama salah satu tweet menfess berikut ini: Gue anak 21, ga nyangka ternyata kuliah itu seburuk itu untuk mental health, semester 1 kemarin gue udah dihujanin materi sama tugas yang bener2 banyak, akibatnya waktu gue untuk healing sama self reward jadi kurang banget. Yang tadinya gw masih bisa nonton netflix sama chat2an sama bestie sekarang jadi susah banget.Gue kayaknya belum siap kuliah deh. Gue udh ngomong ke ortu kalau gue mau cuti dulu semester ini. Gw mau fokus healing selama 6 bulan ini. Tapi ortu gue malah ga setuju. Bahkan gue dibilang manja.Gue bingung mau gimana takutnya kalau paksain ipk ku malah tambah anjlok. Gue juga susah komunikasiin ini ke ortu karena mereka ga aware soal mentalh health kayak gue. Gue mesti gmn 😭https://twitter.com/collegemenfess/status/1492496530804121606 Saya sendiri yakin bahwa program studi atau jurusan yang dia pilih agak dipaksakan dan kurang sesuai hati. Ya, maklum, kenyataannya Teknik Informatika BINUS yang sering didamba-dambakan setiap orang Indo itulah jadi salah satu jurusan BINUS dengan banyak mahasiswa yang akhirnya merasa salah jurusan. Salah satu teman saya yang akhirnya pindah ke Ilmu Komunikasi pernah bahas masalah ini di YouTube: https://www.youtube.com/watch?v=OOmD_2q0w4Q Kuliah di program studi yang sesuai minat dan bakat bakal terasa jauh berbeda dengan kuliah di program studi yang dipaksakan. Buktinya, saya baru bisa mental breakdown saat Semester 5 sedangkan dia baru saat awal semester. Saya bisa bayangkan betapa stresnya kalau saya dipaksakan orang tua untuk masuk ke sarjana ekonomi, hukum, akuntansi, biologi, dan sebagainya. Oh iya, jangan anggap bahwa kuliah itu "tempat untuk belajar" layaknya SMP atau SMA. Untuk bisa menaklukkan kuliah kamu harus belajar, belajar lebih banyak daripada yang diajarkan di kelas. Saya juga yakin kalau sender ini terlalu nyaman untuk lebih fokus pacaran daripada mengejar pendidikan formal. Ya, begitulah... Semester 6 sampai 8 mau ngapain? Pertama-tama, saya ingin uninstall LINE. LINE telah memberikan dampak buruk bagi jumlah unread notifications di iPhone saya: https://twitter.com/alterine0101/status/1481171260260614144?s=20&t=ZcnEEACtBNb2dtnKeYOPvQ Saya pinjam akun salah satu robot saya biat posting ini karena jumlah unread message nya cukup menarik. 1.337, alias "leet". Saya sebenarnya juga ingin meninggalkan Discord, WhatsApp, dan Telegram, dan ingin lebih fokus untuk balas pesan via Signal, Marco Polo, dan mungkin bikin aplikasi chatting dan media sosial sendiri. Lalu, bagi yang belum pernah paham tentang Enrichment Program di BINUS, saya bisa bilang itu sebagai salah satu cikal bakalnya program Kampus Merdeka, di mana 2 semester dipakai untuk mengambil pengalaman via magang, riset, KKN, dan sebagainya. Yang berbeda di sini adalah distribusi SKSnya. Kebetulan, saya memutuskan untuk memilih jalur riset atas berbagai pertimbangan. Karena semester 6 dan 7 isinya Enrichment Program, dan semester 8 bakal penuh dengan skripsi, ketiga semester ini adalah momen di mana setiap mahasiswa BINUS harus bisa mandiri. Tidak ada kelas seperti biasa, tapi tetap ada tugas dari dosen pembimbing. Semester-semester inilah yang menjadi momen pembuktian, apakah yang "cuman ngikutin materi dari BINUS" akan berhasil? Berbicara tentang skripsi, dan rencana saya untuk mengambil skripsi langsung di Semester 7, saya sudah menentukan beberapa kandidat topik yang kemungkinan besar akan dikerjakan. Sekarang, saya perlu untuk menyusun waktu dan menentukan apakah skripsi semester 7 adalah hal yang tepat atau bukan. Akhir kata, kini saya memasuki era yang baru. Terima kasih juga kepada segenap robot saya yang sudah membantu dan memberi semangat saya untuk melewati berbagai perjuangan ini. Sekian blog saya hari ini. Terima kasih.

Masuk LINE TODAYLebih dari 2,000 contributions di GitHubBikin 1 aplikasi baru tiap bulanLulus MSJ 1 & 2Langsung ngegas skripsi (sidang @ Semester 7)Ngajakin lebih banyak orang pergi ke CG (Note: bukan restoran Common Grounds)Punya Shiftine di kehidupan nyata ⬆️ 🤟 🔥