saverf.sa.com Open in urlscan Pro
172.93.120.113  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response saverf.sa.com/	19 KB 19 KB	874ms 79ms	Document text/html	172.93.120.113 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Full URL https://saverf.sa.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.93.120.113 Lenoir, United States, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS relay0-hgeeks18.saatva-digital-sales.com Software Apache / Resource Hash 873db72f8c81372596474efc8f91fb00dfce63cf3f6daf8ea8f58233e15c2046 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 19610 Content-Type text/html Date Thu, 14 Nov 2024 23:27:57 GMT Keep-Alive timeout=5, max=100 Last-Modified Thu, 10 Oct 2024 05:23:44 GMT Server Apache
GET H/1.1	200 OK	jquery.min.js.descarga Show response saverf.sa.com/BDVenl%C3%ADnea%20personas_files/	87 KB 88 KB	232ms 80ms	Script text/javascript	172.93.120.113 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Full URL https://saverf.sa.com/BDVenl%C3%ADnea%20personas_files/jquery.min.js.descarga Requested by Host: saverf.sa.com URL: https://saverf.sa.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.93.120.113 Lenoir, United States, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS relay0-hgeeks18.saatva-digital-sales.com Software Apache / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://saverf.sa.com/ Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 89476 Keep-Alive timeout=5, max=100 Date Thu, 14 Nov 2024 23:27:57 GMT Last-Modified Thu, 10 Oct 2024 05:20:38 GMT Content-Type text/javascript Server Apache
GET H/1.1	200 OK	css.css saverf.sa.com/BDVenl%C3%ADnea%20personas_files/	5 KB 5 KB	103ms 69ms	Stylesheet text/css	172.93.120.113 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Full URL https://saverf.sa.com/BDVenl%C3%ADnea%20personas_files/css.css Requested by Host: saverf.sa.com URL: https://saverf.sa.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.93.120.113 Lenoir, United States, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS relay0-hgeeks18.saatva-digital-sales.com Software Apache / Resource Hash 7eca7cc2128aab9e82b7f675031b981928a2bbdd188835a094a4da3852bdf018 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://saverf.sa.com/ Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 4614 Keep-Alive timeout=5, max=99 Date Thu, 14 Nov 2024 23:27:57 GMT Last-Modified Thu, 10 Oct 2024 05:20:38 GMT Content-Type text/css Server Apache
GET H/1.1	200 OK	styl.css saverf.sa.com/BDVenl%C3%ADnea%20personas_files/	329 KB 329 KB	178ms 72ms	Stylesheet text/css	172.93.120.113 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Full URL https://saverf.sa.com/BDVenl%C3%ADnea%20personas_files/styl.css Requested by Host: saverf.sa.com URL: https://saverf.sa.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.93.120.113 Lenoir, United States, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS relay0-hgeeks18.saatva-digital-sales.com Software Apache / Resource Hash 6ba4fd5fb0cfb45cc5b148e63e3c348c8e5aea351d18e20df3bf093dca390e2c Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://saverf.sa.com/ Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 336729 Keep-Alive timeout=5, max=98 Date Thu, 14 Nov 2024 23:27:57 GMT Last-Modified Thu, 10 Oct 2024 05:20:38 GMT Content-Type text/css Server Apache
GET H2	200	axios.min.js Show response cdn.jsdelivr.net/npm/axios@1.1.2/dist/	26 KB 11 KB	203ms 27ms	Script application/javascript	2606:4700::6812:ba1f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/axios@1.1.2/dist/axios.min.js Requested by Host: saverf.sa.com URL: https://saverf.sa.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:ba1f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ffb6e270a7bbb1ea1b797965ae85e35760b38b98744478a4151ddee79a31d215 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://saverf.sa.com/ Response headers access-control-expose-headers * content-encoding br cf-cache-status HIT etag W/"67d4-ae22gWc+WteU0z+fBbiwjqlAwTs" age 9015287 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ssfywqf3HqCc%2B%2Fl1lc9H3oWHKbXtfWw1AapXUnzGE17Dxt%2BuxweOLY1OVQTru7se9QkulDwIhj7NBZveQ3y9xoSKvWVmSmthn%2BJ%2F1RvYBYnDOYDB4LNwGiIsYssAn6fU4vhgy9ro9Ys8o%2BspeAk%3D"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443"; ma=86400 x-cache HIT, HIT date Thu, 14 Nov 2024 23:27:57 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230112-FRA, cache-lga21920-LGA vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8e2ac66eefc8a26f-YUL accept-ranges bytes access-control-allow-origin * content-length 10349 server cloudflare x-jsd-version 1.1.2
GET H/1.1	200 OK	logo.png saverf.sa.com/BDVenl%C3%ADnea%20personas_files/	31 KB 32 KB	227ms 84ms	Image image/png	172.93.120.113 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Show image Full URL https://saverf.sa.com/BDVenl%C3%ADnea%20personas_files/logo.png Requested by Host: saverf.sa.com URL: https://saverf.sa.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.93.120.113 Lenoir, United States, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS relay0-hgeeks18.saatva-digital-sales.com Software Apache / Resource Hash 2db48f3bb76be4f40a324525d4e872882f59208122f0ea552759eb76beb97d3a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://saverf.sa.com/ Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 32162 Keep-Alive timeout=5, max=100 Date Thu, 14 Nov 2024 23:27:57 GMT Last-Modified Thu, 10 Oct 2024 05:20:38 GMT Content-Type image/png Server Apache
GET H2	200	gtm.js Show response www.googletagmanager.com/	193 KB 70 KB	565ms 47ms	Script application/javascript	2607:f8b0:4004:c0b::61 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-TFBRZ6BL Requested by Host: saverf.sa.com URL: https://saverf.sa.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c0b::61 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 103747835613bf26e5929b0dc0ea1701ab9690c42faf03f2a858d2c6b753c41a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://saverf.sa.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],} expires Thu, 14 Nov 2024 23:27:58 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 14 Nov 2024 23:27:58 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Thu, 14 Nov 2024 23:06:35 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 70625 x-xss-protection 0 server Google Tag Manager
GET H/1.1	200 OK	background.jpg saverf.sa.com/BDVenl%C3%ADnea%20personas_files/	111 KB 111 KB	72ms 72ms	Image image/jpeg	172.93.120.113 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Show image Full URL https://saverf.sa.com/BDVenl%C3%ADnea%20personas_files/background.jpg Requested by Host: saverf.sa.com URL: https://saverf.sa.com/BDVenl%C3%ADnea%20personas_files/styl.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.93.120.113 Lenoir, United States, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS relay0-hgeeks18.saatva-digital-sales.com Software Apache / Resource Hash f9bcc55b790b84873ed399aa0fa604cf9b9bec3b5a94b6869e6d00bb29ff72c3 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://saverf.sa.com/BDVenl%C3%ADnea%20personas_files/styl.css Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 113584 Keep-Alive timeout=5, max=97 Date Thu, 14 Nov 2024 23:27:57 GMT Last-Modified Thu, 10 Oct 2024 05:20:38 GMT Content-Type image/jpeg Server Apache
GET H3	200	XRXV3I6Li01BKofINeaB.woff2 fonts.gstatic.com/s/nunito/v25/	35 KB 35 KB	484ms 33ms	Font font/woff2	64.233.180.94 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/nunito/v25/XRXV3I6Li01BKofINeaB.woff2 Requested by Host: saverf.sa.com URL: https://saverf.sa.com/BDVenl%C3%ADnea%20personas_files/css.css Protocol H3 Security QUIC, , AES_128_GCM Server 64.233.180.94 , United States, ASN15169 (GOOGLE, US), Reverse DNS on-in-f94.1e100.net Software sffe / Resource Hash 96217f1d27fb909f92b4a6b35a0d3d6775f2f0b4d136d27aee88547d3ed87357 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://saverf.sa.com Referer https://saverf.sa.com/ Response headers age 562870 report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} x-content-type-options nosniff expires Sat, 08 Nov 2025 11:06:48 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Fri, 08 Nov 2024 11:06:48 GMT last-modified Mon, 18 Jul 2022 19:34:47 GMT content-type font/woff2 cache-control public, max-age=31536000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="apps-themes" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes accept-ranges bytes access-control-allow-origin * content-length 35904 x-xss-protection 0 server sffe
GET H/1.1	200	favicon-16x16.png bdvenlinea.banvenez.com/assets/favicon/	677 B 2 KB	815ms 161ms	Other image/png	66.22.114.4
General Check archive.org Show headers Download Go to Full URL https://bdvenlinea.banvenez.com/assets/favicon/favicon-16x16.png Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.22.114.4 , United States, ASN (), Reverse DNS Software / Resource Hash 43d18e4fa9e275916b672a6c3118bcbd2824f944236dcc70a80ba4a705f1fa76 Security Headers Name Value Strict-Transport-Security max-age=31536000 ; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://saverf.sa.com/ Response headers Access-Control-Max-Age 3600 Access-Control-Allow-Methods POST, GET, OPTIONS, DELETE X-Content-Type-Options nosniff Expires 0 Keep-Alive timeout=60 Date Thu, 14 Nov 2024 23:27:46 GMT Last-Modified Wed, 13 Nov 2024 03:02:27 GMT Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Content-Type image/png X-Frame-Options DENY Access-Control-Allow-Headers Content-Type, Authorization, revoke, refreshtoken, Rip,xsrf-token Strict-Transport-Security max-age=31536000 ; includeSubDomains Transfer-Encoding chunked Cache-Control no-cache, no-store, max-age=0, must-revalidate Pragma no-cache Accept-Ranges bytes Access-Control-Allow-Origin https://bdvenlinea.banvenez.com X-XSS-Protection 1; mode=block
GET H/1.1	200	favicon-32x32.png bdvenlinea.banvenez.com/assets/favicon/	1 KB 3 KB	151ms 150ms	Other image/png	66.22.114.4
General Check archive.org Show headers Download Go to Full URL https://bdvenlinea.banvenez.com/assets/favicon/favicon-32x32.png Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.22.114.4 , United States, ASN (), Reverse DNS Software / Resource Hash 2504cdef62de2d64b21cb493d92260a40aae71c8c69eea7fc991f248f1133e41 Security Headers Name Value Strict-Transport-Security max-age=31536000 ; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://saverf.sa.com/ Response headers Access-Control-Max-Age 3600 Content-Encoding gzip Access-Control-Allow-Methods POST, GET, OPTIONS, DELETE X-Content-Type-Options nosniff Expires 0 Keep-Alive timeout=60 Date Thu, 14 Nov 2024 23:30:56 GMT Last-Modified Wed, 13 Nov 2024 03:02:27 GMT Vary origin,access-control-request-method,access-control-request-headers,accept-encoding Content-Type image/png Access-Control-Allow-Headers Content-Type, Authorization, revoke, refreshtoken, Rip,xsrf-token X-Frame-Options DENY Strict-Transport-Security max-age=31536000 ; includeSubDomains Transfer-Encoding chunked Cache-Control no-cache, no-store, max-age=0, must-revalidate Pragma no-cache Accept-Ranges bytes Access-Control-Allow-Origin https://bdvenlinea.banvenez.com X-XSS-Protection 1; mode=block

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco de Venezuela (Banking)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| dataLayer function| $ function| jQuery function| axios function| chcs function| chc function| cls function| carl object| google_tag_manager object| google_tag_data

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bdvenlinea.banvenez.com
cdn.jsdelivr.net
fonts.gstatic.com
saverf.sa.com
www.googletagmanager.com
172.93.120.113
2606:4700::6812:ba1f
2607:f8b0:4004:c0b::61
64.233.180.94
66.22.114.4
103747835613bf26e5929b0dc0ea1701ab9690c42faf03f2a858d2c6b753c41a
2504cdef62de2d64b21cb493d92260a40aae71c8c69eea7fc991f248f1133e41
2db48f3bb76be4f40a324525d4e872882f59208122f0ea552759eb76beb97d3a
43d18e4fa9e275916b672a6c3118bcbd2824f944236dcc70a80ba4a705f1fa76
6ba4fd5fb0cfb45cc5b148e63e3c348c8e5aea351d18e20df3bf093dca390e2c
7eca7cc2128aab9e82b7f675031b981928a2bbdd188835a094a4da3852bdf018
873db72f8c81372596474efc8f91fb00dfce63cf3f6daf8ea8f58233e15c2046
96217f1d27fb909f92b4a6b35a0d3d6775f2f0b4d136d27aee88547d3ed87357
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f9bcc55b790b84873ed399aa0fa604cf9b9bec3b5a94b6869e6d00bb29ff72c3
ffb6e270a7bbb1ea1b797965ae85e35760b38b98744478a4151ddee79a31d215