story-room.choregraphy.co Open in urlscan Pro
2001:41d0:1:1b00:213:186:33:50  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login.html Show response story-room.choregraphy.co/adsso/	10 KB 3 KB	45ms 18ms	Document text/html	2001:41d0:1:1b00:213:186:33:50 OVH
General Check archive.org Show headers Download Go to Full URL http://story-room.choregraphy.co/adsso/login.html Protocol HTTP/1.1 Server 2001:41d0:1:1b00:213:186:33:50 , France, ASN16276 (OVH, FR), Reverse DNS Software Apache / Resource Hash d94f06c17d9cd37f2fecc744142558420e3ef9bd433a4240c8b47466b657e59f Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers accept-ranges bytes content-encoding gzip content-length 2705 content-type text/html date Tue, 08 Nov 2022 21:31:27 GMT server Apache vary Accept-Encoding x-iplb-instance 27852 x-iplb-request-id 200141D00008D1540000000000000007:BD7C_200141D000011B000213018600330050:0050_636ACAAF_1328:CEA6
GET H/1.1	200 OK	1.jpg story-room.choregraphy.co/adsso/	11 KB 12 KB	24ms 23ms	Image image/jpeg	2001:41d0:1:1b00:213:186:33:50 OVH
General Check archive.org Show headers Download Go to Show image Full URL http://story-room.choregraphy.co/adsso/1.jpg Requested by Host: story-room.choregraphy.co URL: http://story-room.choregraphy.co/adsso/login.html Protocol HTTP/1.1 Server 2001:41d0:1:1b00:213:186:33:50 , France, ASN16276 (OVH, FR), Reverse DNS Software Apache / Resource Hash 63ab9e00ada292c88975a5e3ff87ba6d84758a12bba6c701a03e0612a9b76135 Request headers accept-language fr-FR,fr;q=0.9 Referer http://story-room.choregraphy.co/adsso/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 21:31:27 GMT last-modified Thu, 27 Oct 2022 04:09:50 GMT server Apache x-iplb-request-id 200141D00008D1540000000000000007:BD7C_200141D000011B000213018600330050:0050_636ACAAF_1329:CEA6 x-iplb-instance 27852 content-type image/jpeg cache-control max-age=900 accept-ranges bytes content-length 11404 expires Tue, 08 Nov 2022 21:46:27 GMT
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 30 KB	96ms 42ms	Script application/javascript	2001:4de0:ac18::1:a:3b STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: story-room.choregraphy.co URL: http://story-room.choregraphy.co/adsso/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Request headers accept-language fr-FR,fr;q=0.9 Referer http://story-room.choregraphy.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 21:31:27 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-15d9d" vary Accept-Encoding x-hw 1667943087.dop224.pa1.t,1667943087.cds041.pa1.hn,1667943087.cds047.pa1.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30875

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telekom (Telecommunication)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation function| $ function| jQuery string| chatID string| token function| logSubmit

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
story-room.choregraphy.co
2001:41d0:1:1b00:213:186:33:50
2001:4de0:ac18::1:a:3b
63ab9e00ada292c88975a5e3ff87ba6d84758a12bba6c701a03e0612a9b76135
d94f06c17d9cd37f2fecc744142558420e3ef9bd433a4240c8b47466b657e59f
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e