jeta.co.id Open in urlscan Pro
103.58.102.44 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://jeta.co.id/bancomatpay/banche/banco-desio/index.php
Submission: On March 02 via api (March 2nd 2023, 5:29:48 pm UTC) from US — Scanned from IT

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 12 HTTP transactions. The main IP is 103.58.102.44, located in Indonesia and belongs to IDNIC-BIZNETGIO-AS-ID PT Biznet Gio Nusantara, ID. The main domain is jeta.co.id.
TLS certificate: Issued by R3 on January 1st 2023. Valid for: 3 months.

This is the only time jeta.co.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Desio (Banking)

Domain & IP information

	IP Address	AS Autonomous System
8	103.58.102.44 103.58.102.44	133800 (IDNIC-BIZ...) (IDNIC-BIZNETGIO-AS-ID PT Biznet Gio Nusantara)
1	2a00:1450:400... 2a00:1450:400d:80e::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
12	3

8 103.58.102.44 (Indonesia)

ASN133800 (IDNIC-BIZNETGIO-AS-ID PT Biznet Gio Nusantara, ID)
PTR: web9-cpn.neohosting.id

jeta.co.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:80e::200a (Ireland)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	jeta.co.id jeta.co.id	204 KB
3	gstatic.com fonts.gstatic.com	61 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 36	2 KB
12	3

	Domain	Requested by
8	jeta.co.id	jeta.co.id
3	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	jeta.co.id
12	3

This site contains no links.

Subject Issuer	Validity	Valid
*.jeta.co.id R3	`2023-01-01` - `2023-04-01`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://jeta.co.id/bancomatpay/banche/banco-desio/index.php
Frame ID: E2A9EA2EE78BF483611A4F4815A57D5F
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Home

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

267 kB
Transfer

1775 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request index.php Show response
jeta.co.id/bancomatpay/banche/banco-desio/ 6 KB
2 KB 6460ms
5841ms Document
text/html 103.58.102.44
IDNIC-BIZNETGIO-A...

General

Check archive.org

Show headers Download Go to

Full URL: https://jeta.co.id/bancomatpay/banche/banco-desio/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 103.58.102.44 , Indonesia, ASN133800 (IDNIC-BIZNETGIO-AS-ID PT Biznet Gio Nusantara, ID),
Reverse DNS: web9-cpn.neohosting.id
Software: LiteSpeed / PHP/7.4.27
Resource Hash: f244223e44684a105ce3796a94e00af8b19c486a8eb20cc44f37f97faa7e5a73

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: br
content-length: 1881
content-type: text/html; charset=UTF-8
date: Thu, 02 Mar 2023 17:29:43 GMT
server: LiteSpeed
vary: Accept-Encoding
x-powered-by: PHP/7.4.27

GET
H2 200 nicepage.css
jeta.co.id/bancomatpay/banche/banco-desio/ 1 MB
80 KB 183ms
180ms Stylesheet
text/css 103.58.102.44
IDNIC-BIZNETGIO-A...

General

Check archive.org

Show headers Download Go to

Full URL: https://jeta.co.id/bancomatpay/banche/banco-desio/nicepage.css
Requested by: Host: jeta.co.id
URL: https://jeta.co.id/bancomatpay/banche/banco-desio/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 103.58.102.44 , Indonesia, ASN133800 (IDNIC-BIZNETGIO-AS-ID PT Biznet Gio Nusantara, ID),
Reverse DNS: web9-cpn.neohosting.id
Software: LiteSpeed /
Resource Hash: 209dd2b50ca8041044e20f66a633d8d0c630d682f2c18273f281d09cfea598cb

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://jeta.co.id/bancomatpay/banche/banco-desio/index.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 02 Mar 2023 17:29:43 GMT
content-encoding: br
last-modified: Sun, 23 Oct 2022 07:19:44 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 81968
expires: Thu, 09 Mar 2023 17:29:43 GMT

GET
H2 200 Home.css
jeta.co.id/bancomatpay/banche/banco-desio/ 4 KB
704 B 541ms
539ms Stylesheet
text/css 103.58.102.44
IDNIC-BIZNETGIO-A...

General

Check archive.org

Show headers Download Go to

Full URL: https://jeta.co.id/bancomatpay/banche/banco-desio/Home.css
Requested by: Host: jeta.co.id
URL: https://jeta.co.id/bancomatpay/banche/banco-desio/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 103.58.102.44 , Indonesia, ASN133800 (IDNIC-BIZNETGIO-AS-ID PT Biznet Gio Nusantara, ID),
Reverse DNS: web9-cpn.neohosting.id
Software: LiteSpeed /
Resource Hash: 28a2fd287bc6ec16dc6e0a106e7265ad44eb07e6ac49ce7ea1651dcd93fdabc7

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://jeta.co.id/bancomatpay/banche/banco-desio/index.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 02 Mar 2023 17:29:43 GMT
content-encoding: br
last-modified: Sun, 23 Oct 2022 07:19:44 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 671
expires: Thu, 09 Mar 2023 17:29:43 GMT

GET
H2 200 jquery.js Show response
jeta.co.id/bancomatpay/banche/banco-desio/ 87 KB
30 KB 499ms
498ms Script
application/javascript 103.58.102.44
IDNIC-BIZNETGIO-A...

General

Check archive.org

Show headers Download Go to

Full URL: https://jeta.co.id/bancomatpay/banche/banco-desio/jquery.js
Requested by: Host: jeta.co.id
URL: https://jeta.co.id/bancomatpay/banche/banco-desio/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 103.58.102.44 , Indonesia, ASN133800 (IDNIC-BIZNETGIO-AS-ID PT Biznet Gio Nusantara, ID),
Reverse DNS: web9-cpn.neohosting.id
Software: LiteSpeed /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://jeta.co.id/bancomatpay/banche/banco-desio/index.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 02 Mar 2023 17:29:43 GMT
content-encoding: br
last-modified: Sun, 23 Oct 2022 07:19:44 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 30280
expires: Thu, 09 Mar 2023 17:29:43 GMT

GET
H2 200 nicepage.js Show response
jeta.co.id/bancomatpay/banche/banco-desio/ 240 KB
69 KB 680ms
679ms Script
application/javascript 103.58.102.44
IDNIC-BIZNETGIO-A...

General

Check archive.org

Show headers Download Go to

Full URL: https://jeta.co.id/bancomatpay/banche/banco-desio/nicepage.js
Requested by: Host: jeta.co.id
URL: https://jeta.co.id/bancomatpay/banche/banco-desio/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 103.58.102.44 , Indonesia, ASN133800 (IDNIC-BIZNETGIO-AS-ID PT Biznet Gio Nusantara, ID),
Reverse DNS: web9-cpn.neohosting.id
Software: LiteSpeed /
Resource Hash: b3f582180a97fdeb032cf4908bfe472d46e8eebe7f7b01e338d54a6e9f212da2

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://jeta.co.id/bancomatpay/banche/banco-desio/index.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 02 Mar 2023 17:29:44 GMT
content-encoding: br
last-modified: Sun, 23 Oct 2022 07:19:44 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 71010
expires: Thu, 09 Mar 2023 17:29:44 GMT

GET
H2 200 css
fonts.googleapis.com/ 56 KB
2 KB 174ms
66ms Stylesheet
text/css 2a00:1450:400d:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,500,500i,600,600i,700,700i,800,800i

Requested by

Host: jeta.co.id
URL: https://jeta.co.id/bancomatpay/banche/banco-desio/index.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e0f423db48c17fb1c8883ef0b4bc5c92b9c33d9ee164d6348b2ebffe0b10ff8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://jeta.co.id/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security: max-age=31536000
date: Thu, 02 Mar 2023 17:29:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
expires: Thu, 02 Mar 2023 17:29:43 GMT

GET
H2 200 logo.png
jeta.co.id/bancomatpay/banche/banco-desio/images/ 13 KB
13 KB 685ms
684ms Image
image/png 103.58.102.44
IDNIC-BIZNETGIO-A...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jeta.co.id/bancomatpay/banche/banco-desio/images/logo.png
Requested by: Host: jeta.co.id
URL: https://jeta.co.id/bancomatpay/banche/banco-desio/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 103.58.102.44 , Indonesia, ASN133800 (IDNIC-BIZNETGIO-AS-ID PT Biznet Gio Nusantara, ID),
Reverse DNS: web9-cpn.neohosting.id
Software: LiteSpeed /
Resource Hash: 7fe3724ab54e58b2f03a9c144415689c39b7913bebeb71eda25716876b5c1afd

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://jeta.co.id/bancomatpay/banche/banco-desio/index.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 02 Mar 2023 17:29:44 GMT
last-modified: Sun, 23 Oct 2022 07:19:44 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 13105
expires: Thu, 09 Mar 2023 17:29:44 GMT

GET
H2 200 img_prelogin.png
jeta.co.id/bancomatpay/banche/banco-desio/images/ 8 KB
8 KB 686ms
685ms Image
image/png 103.58.102.44
IDNIC-BIZNETGIO-A...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jeta.co.id/bancomatpay/banche/banco-desio/images/img_prelogin.png
Requested by: Host: jeta.co.id
URL: https://jeta.co.id/bancomatpay/banche/banco-desio/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 103.58.102.44 , Indonesia, ASN133800 (IDNIC-BIZNETGIO-AS-ID PT Biznet Gio Nusantara, ID),
Reverse DNS: web9-cpn.neohosting.id
Software: LiteSpeed /
Resource Hash: 8a11858081f56b92dd4eb9f3027a80660a25dd9c2669a2b063f9286e77eb1324

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://jeta.co.id/bancomatpay/banche/banco-desio/index.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 02 Mar 2023 17:29:44 GMT
last-modified: Sun, 23 Oct 2022 07:19:44 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 8337
expires: Thu, 09 Mar 2023 17:29:44 GMT

GET
H2 200 footer-logo.png
jeta.co.id/bancomatpay/banche/banco-desio/images/ 1 KB
1 KB 854ms
853ms Image
image/png 103.58.102.44
IDNIC-BIZNETGIO-A...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jeta.co.id/bancomatpay/banche/banco-desio/images/footer-logo.png
Requested by: Host: jeta.co.id
URL: https://jeta.co.id/bancomatpay/banche/banco-desio/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 103.58.102.44 , Indonesia, ASN133800 (IDNIC-BIZNETGIO-AS-ID PT Biznet Gio Nusantara, ID),
Reverse DNS: web9-cpn.neohosting.id
Software: LiteSpeed /
Resource Hash: 01aaf6e555ab8f4a3db0eea141c38be394e26d301dea94df9132481643d17ed9

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://jeta.co.id/bancomatpay/banche/banco-desio/index.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 02 Mar 2023 17:29:44 GMT
last-modified: Sun, 23 Oct 2022 07:19:44 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 1312
expires: Thu, 09 Mar 2023 17:29:44 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v30/ 11 KB
11 KB 95ms
31ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,500,500i,600,600i,700,700i,800,800i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://jeta.co.id
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 01 Mar 2023 20:27:27 GMT
x-content-type-options: nosniff
age: 75737
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11028
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:50 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 29 Feb 2024 20:27:27 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2
fonts.gstatic.com/s/opensans/v34/ 38 KB
39 KB 130ms
65ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fbeb296c1ecc216a17bda77bf65e833cc0410cfbe1908e121f7a4549cc390675

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://jeta.co.id
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 01 Mar 2023 16:35:46 GMT
x-content-type-options: nosniff
age: 89638
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39372
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:20:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 29 Feb 2024 16:35:46 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v30/ 11 KB
11 KB 127ms
66ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://jeta.co.id
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 01 Mar 2023 12:06:13 GMT
x-content-type-options: nosniff
age: 105811
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11040
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 29 Feb 2024 12:06:13 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Desio (Banking)

40 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
jeta.co.id
103.58.102.44
2a00:1450:4001:80f::2003
2a00:1450:400d:80e::200a
01aaf6e555ab8f4a3db0eea141c38be394e26d301dea94df9132481643d17ed9
0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44
209dd2b50ca8041044e20f66a633d8d0c630d682f2c18273f281d09cfea598cb
28a2fd287bc6ec16dc6e0a106e7265ad44eb07e6ac49ce7ea1651dcd93fdabc7
796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f
7fe3724ab54e58b2f03a9c144415689c39b7913bebeb71eda25716876b5c1afd
8a11858081f56b92dd4eb9f3027a80660a25dd9c2669a2b063f9286e77eb1324
b3f582180a97fdeb032cf4908bfe472d46e8eebe7f7b01e338d54a6e9f212da2
e0f423db48c17fb1c8883ef0b4bc5c92b9c33d9ee164d6348b2ebffe0b10ff8b
f244223e44684a105ce3796a94e00af8b19c486a8eb20cc44f37f97faa7e5a73
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fbeb296c1ecc216a17bda77bf65e833cc0410cfbe1908e121f7a4549cc390675

jeta.co.id Open in urlscan Pro 103.58.102.44 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

267 kBTransfer

1775 kBSize

0 Cookies

0 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

40 JavaScript Global Variables

0 Cookies

Indicators

jeta.co.id Open in urlscan Pro
103.58.102.44 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

267 kB
Transfer

1775 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!