![](/screenshots/7637c780-c1ed-4fec-aa3a-5db5413b1c30.png)
choreosavedana.choreodevss.cfd
Open in
urlscan Pro
172.67.195.111
Malicious Activity!
Public Scan
Effective URL: https://choreosavedana.choreodevss.cfd/
Submission: On July 22 via automatic, source openphish — Scanned from US
Summary
TLS certificate: Issued by WE1 on July 12th 2024. Valid for: 3 months.
This is the only time choreosavedana.choreodevss.cfd was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DANA (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 172.67.195.111 172.67.195.111 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2607:f8b0:400... 2607:f8b0:400d:c0e::5f | 15169 (GOOGLE) (GOOGLE) | |
4 | 2606:50c0:800... 2606:50c0:8000::153 | 54113 (FASTLY) (FASTLY) | |
1 | 23.207.202.12 23.207.202.12 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 172.67.69.24 172.67.69.24 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 2607:f8b0:400... 2607:f8b0:4004:c07::84 | 15169 (GOOGLE) (GOOGLE) | |
1 | 173.223.163.219 173.223.163.219 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2607:f8b0:400... 2607:f8b0:400d:c0d::5e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2607:f8b0:400... 2607:f8b0:400d:c0b::66 | 15169 (GOOGLE) (GOOGLE) | |
18 | 10 |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-207-202-12.deploy.static.akamaitechnologies.com
www.dana.id |
ASN15169 (GOOGLE, US)
blogger.googleusercontent.com |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a173-223-163-219.deploy.static.akamaitechnologies.com
a.m.dana.id |
ASN15169 (GOOGLE, US)
encrypted-tbn0.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
googleusercontent.com
blogger.googleusercontent.com — Cisco Umbrella Rank: 7953 |
2 MB |
4 |
github.io
owlcarousel2.github.io — Cisco Umbrella Rank: 146082 |
52 KB |
2 |
gstatic.com
fonts.gstatic.com encrypted-tbn0.gstatic.com |
34 KB |
2 |
dana.id
www.dana.id — Cisco Umbrella Rank: 114928 a.m.dana.id — Cisco Umbrella Rank: 23999 |
271 KB |
2 |
choreodevss.cfd
choreosavedana.choreodevss.cfd |
6 KB |
1 |
poskota.co.id
gallery.poskota.co.id — Cisco Umbrella Rank: 181766 |
46 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 110 |
928 B |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 336 |
953 B |
18 | 8 |
Domain | Requested by | |
---|---|---|
5 | blogger.googleusercontent.com |
choreosavedana.choreodevss.cfd
|
4 | owlcarousel2.github.io |
choreosavedana.choreodevss.cfd
|
2 | choreosavedana.choreodevss.cfd |
choreosavedana.choreodevss.cfd
|
1 | encrypted-tbn0.gstatic.com | |
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | a.m.dana.id |
choreosavedana.choreodevss.cfd
|
1 | gallery.poskota.co.id |
choreosavedana.choreodevss.cfd
|
1 | www.dana.id |
choreosavedana.choreodevss.cfd
|
1 | fonts.googleapis.com |
choreosavedana.choreodevss.cfd
|
1 | cdnjs.cloudflare.com |
choreosavedana.choreodevss.cfd
|
18 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
choreodevss.cfd WE1 |
2024-07-12 - 2024-10-10 |
3 months | crt.sh |
cdnjs.cloudflare.com E1 |
2024-06-02 - 2024-08-31 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
*.github.io DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-03-15 - 2025-03-14 |
a year | crt.sh |
www.dana.id DigiCert TLS RSA SHA256 2020 CA1 |
2023-08-08 - 2024-08-07 |
a year | crt.sh |
poskota.co.id E1 |
2024-06-05 - 2024-09-03 |
3 months | crt.sh |
*.googleusercontent.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
a.m.dana.id DigiCert TLS RSA SHA256 2020 CA1 |
2023-08-08 - 2024-08-07 |
a year | crt.sh |
*.gstatic.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://choreosavedana.choreodevss.cfd/
Frame ID: 6E7560A30F3738D603EB6D8C40E9426A
Requests: 18 HTTP requests in this frame
Screenshot
![](/screenshots/7637c780-c1ed-4fec-aa3a-5db5413b1c30.png)
Page Title
D A N A IDPage URL History Show full URLs
-
http://choreosavedana.choreodevss.cfd/
HTTP 307
https://choreosavedana.choreodevss.cfd/ Page URL
Detected technologies
Detected patterns
- /_nuxt/
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
![](/vendor/wappa/icons/OWL Carousel.png)
Detected patterns
- <link [^>]*href="[^"]+owl\.carousel(?:\.min)?\.css
- owl\.carousel.*\.js
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://choreosavedana.choreodevss.cfd/
HTTP 307
https://choreosavedana.choreodevss.cfd/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
choreosavedana.choreodevss.cfd/ Redirect Chain
|
19 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
reset.min.css
cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/ |
773 B 953 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
1 KB 928 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style.css
choreosavedana.choreodevss.cfd/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owl.carousel.min.css
owlcarousel2.github.io/OwlCarousel2/assets/owlcarousel/assets/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owl.theme.default.min.css
owlcarousel2.github.io/OwlCarousel2/assets/owlcarousel/assets/ |
1013 B 906 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
owlcarousel2.github.io/OwlCarousel2/assets/vendors/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owl.carousel.js
owlcarousel2.github.io/OwlCarousel2/assets/owlcarousel/ |
88 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dana-logo.fe46647.png
www.dana.id/_nuxt/img/ |
12 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
dana-kaget-dana.jpg
gallery.poskota.co.id/storage/Foto/ |
45 KB 46 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AddText_05-06-07.24.07.png
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiay900qDhJBTrVpMKboyHBG-112n5BezC6lE5EfrTp52boqs69BJSQAAqtGaswUyYJ7_5AXEeOhCPpfIDAelfG_uvvbX3ToIyuBYzymdUefAuzBp6BFOiAV0E4hJi9JDK0ukK7J6WOLHUZ_Mgh... |
105 KB 105 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
load_bg.png
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8hbZEfutKvr9pkj0-mkJYWt-1SBtt3gw-HFOEZc0172okrp0SFHLaW3PRGVDm1U0P7WWEMELIw4nlq1_1gCgyZBo3cxf-OJNpguNamdJryCkGU-hTHiW3RyOv5JD9eIjXTFtrJFCVn0ae4RxG... |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
load_spin.png
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhl9xJVYWF_a9vAhgW5QQgozvZVADTaJgIX64iO7a5sQuMpSoPBK3zfKjvT6xc9fZPfxZz39mjk1H_oZOOOtYvO1l7DkWNqiD5LJyGYdwDNyHuyqLk_Ix6eFs3aLCG2yUXVwtsnj0BXTA40WZme... |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1704436332522.png
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhW-3Xsq1r5wVb5r0tfUzFr9KzB9hy1r0-W4GkBcDTnYujbw_NNeMWw-l8MZCk4RYNJpcSZRf5tv-TPa5HnYvv_x-EzticmLwx1vO4bIlqTJAiyk4-i96QjCFlPHT8BMy9nF15ISyjxVVOz2DAv... |
90 KB 90 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hero-personal-bg-back.png
a.m.dana.id/resource/danaweb-v2/ |
257 KB 257 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AddText_04-03-07.31.42.png
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHG8bz71IvIJl3PSWe5SPQf2uqQRQd7iX915m31vSQDrIrovNA6ILfIsJj7ePkpIAgn7SBUDGkNctPgm1V0Wj1g1NZCq50Ayw-2r8S0ekfxNwrUpaZ_3rDwwk46KJ8T6ro1LZDWKkFXKdQoV-T... |
2 MB 2 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
w8gdH283Tvk__Lua32TysjIfp8uP.woff2
fonts.gstatic.com/s/varelaround/v20/ |
21 KB 22 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
images
encrypted-tbn0.gstatic.com/ |
11 KB 12 KB |
Other
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DANA (Financial)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| handleFirstPlay object| owl function| toggleMute function| delay function| showVideo object| dana1 object| dana2 object| dana3 object| dana4 function| play_Audio1 function| play_Audio2 function| play_Audio3 function| play_Audio4 function| letsgo0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
a.m.dana.id
blogger.googleusercontent.com
cdnjs.cloudflare.com
choreosavedana.choreodevss.cfd
encrypted-tbn0.gstatic.com
fonts.googleapis.com
fonts.gstatic.com
gallery.poskota.co.id
owlcarousel2.github.io
www.dana.id
104.17.25.14
172.67.195.111
172.67.69.24
173.223.163.219
23.207.202.12
2606:50c0:8000::153
2607:f8b0:4004:c07::84
2607:f8b0:400d:c0b::66
2607:f8b0:400d:c0d::5e
2607:f8b0:400d:c0e::5f
00126c88e5f527e92a6095ca9dc1daa3cde773531debdd68257550f1eb99b638
0546f98f9019a3d2afbe9372ba08aba895e2aa716bd0fec8e78ff5879162f134
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2044a0abfd7b116f6d091d6d9227a5720bd4848519cd38d274b2a3a9356969dd
4081dece9b9ac9e3a883a19a583790fe9ae5537a55f25fd28fa506e490839904
521410e1fc44780061e09adc980275fb5ea277fd5d9e538454214ec4379ff4bc
82f1278f66b192a223e306d884f8db595ef3b6d829cc1544807b9bf40019403e
87a91c07755e52db62f49bc10aaec3cfd5fa2930a1d39ddba1827b2c365ff905
8d7aef89df5aa26fab6f1049d29067638b044525ff6738d4b5893b814129b162
924b0dc630d1c5dff9fa31aead9509775b1d476bfe0a5ac2977b2f11205a26ac
9f2f502509f3cdd2e98dc540b4f7dd57a7962524012e0210e1ef64cee17d79ae
c67e5431f9c00bb690ea8b8add63d5ca9250bf2925f2c2a691eeee498ac75853
cd920928599c4bb9610772f2120b1de88fec4b199ba7432d2742f07f4ab3013a
d407678c5a8e6dcc80a5c3c8b3cff9ec03222b03cc70b6489cfad137f6dfc2f0
db9d6cf3c1c4b047c62f646e7d9991c06a212931c362bf53f9a2406b30f09466
f386554dbf390b4ab08123fb5466f5d833c12de955344ce9ea722e1182cc473f
faf0a07a64b78a8541915e5b0e779b8092d8f059e0cfeadcd295354abc4b5d4f