dentamasmulia.com Open in urlscan Pro
219.83.68.92 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://spoteam.msnd1.com/tracking/lc/967568ae-f952-4eb3-9573-c1316393181b/714ec373-6a6a-46e1-9c49-980d7cb0681f/4c30ad55-9...
Effective URL:
https://dentamasmulia.com/paymentupdate/Spotify-Login/signin.php?verify_account=session1097fbc4b278d8489e1d584b014d76b2&li...
Submission: On October 27 via manual (October 27th 2019, 3:09:48 pm UTC) from US

Summary HTTP 7 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 7 domains to perform 7 HTTP transactions. The main IP is 219.83.68.92, located in Bandung, Indonesia and belongs to INDOSATM2-ID INDOSATM2 ASN, ID. The main domain is dentamasmulia.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 23rd 2019. Valid for: 3 months.

This is the only time dentamasmulia.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Spotify (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	212.32.243.39 212.32.243.39	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
1 1	217.23.132.84 217.23.132.84	197695 (AS-REG) (AS-REG)
1 2	219.83.68.92 219.83.68.92	4795 (INDOSATM2...) (INDOSATM2-ID INDOSATM2 ASN)
1	151.101.12.246 151.101.12.246	54113 (FASTLY) (FASTLY - Fastly)
1	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:819::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
3	151.101.13.194 151.101.13.194	54113 (FASTLY) (FASTLY - Fastly)
7	6

1 212.32.243.39 (Zevenaar, Netherlands) 1 redirects

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

spoteam.msnd1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 217.23.132.84 (Russian Federation) 1 redirects

ASN197695 (AS-REG, RU)
PTR: yaxo.ru

clinitek.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 219.83.68.92 (Bandung, Indonesia) 1 redirects

ASN4795 (INDOSATM2-ID INDOSATM2 ASN, ID)
PTR: gondolayu.idweb.host

dentamasmulia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.246 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

accounts.scdn.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.13.194 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

sp-bootstrap.global.ssl.fastly.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	fastly.net sp-bootstrap.global.ssl.fastly.net	216 KB
2	dentamasmulia.com 1 redirects dentamasmulia.com	2 KB
1	google-analytics.com www.google-analytics.com	18 KB
1	gstatic.com www.gstatic.com	92 KB
1	scdn.co accounts.scdn.co	49 KB
1	clinitek.ru 1 redirects clinitek.ru	262 B
1	msnd1.com 1 redirects spoteam.msnd1.com	625 B
7	7

	Domain	Requested by
3	sp-bootstrap.global.ssl.fastly.net	dentamasmulia.com
2	dentamasmulia.com	1 redirects
1	www.google-analytics.com	dentamasmulia.com
1	www.gstatic.com	dentamasmulia.com
1	accounts.scdn.co	dentamasmulia.com
1	clinitek.ru	1 redirects
1	spoteam.msnd1.com	1 redirects
7	7

This site contains no links.

Subject Issuer	Validity	Valid
dentamasmulia.com cPanel, Inc. Certification Authority	`2019-10-23` - `2020-01-21`	3 months	crt.sh
*.scdn.co DigiCert SHA2 Secure Server CA	`2018-06-26` - `2020-08-14`	2 years	crt.sh
*.google.com GTS CA 1O1	`2019-10-10` - `2020-01-02`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-10-10` - `2020-01-02`	3 months	crt.sh
*.freetls.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-01-02` - `2020-01-03`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://dentamasmulia.com/paymentupdate/Spotify-Login/signin.php?verify_account=session1097fbc4b278d8489e1d584b014d76b2&lim_session=7edace115a1b57a8e63a4eb3b64230e30bceff88
Frame ID: F449C43693FB26A4A5169BF47EC19FFB
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://spoteam.msnd1.com/tracking/lc/967568ae-f952-4eb3-9573-c1316393181b/714ec373-6a6a-46e1-9c49-980... HTTP 302
http://clinitek.ru/wp-content/themes/spo.php HTTP 302
https://dentamasmulia.com/paymentupdate/Spotify-Login/ HTTP 302
https://dentamasmulia.com/paymentupdate/Spotify-Login/signin.php?verify_account=session1097fbc4b278d84... Page URL

Detected technologies

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

7
Requests

100 %
HTTPS

29 %
IPv6

7
Domains

7
Subdomains

6
IPs

4
Countries

376 kB
Transfer

813 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://spoteam.msnd1.com/tracking/lc/967568ae-f952-4eb3-9573-c1316393181b/714ec373-6a6a-46e1-9c49-980d7cb0681f/4c30ad55-9b76-4af6-ba59-d14fead0b6b0/ HTTP 302
http://clinitek.ru/wp-content/themes/spo.php HTTP 302
https://dentamasmulia.com/paymentupdate/Spotify-Login/ HTTP 302
https://dentamasmulia.com/paymentupdate/Spotify-Login/signin.php?verify_account=session1097fbc4b278d8489e1d584b014d76b2&lim_session=7edace115a1b57a8e63a4eb3b64230e30bceff88 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request signin.php Show response
dentamasmulia.com/paymentupdate/Spotify-Login/
Redirect Chain

http://spoteam.msnd1.com/tracking/lc/967568ae-f952-4eb3-9573-c1316393181b/714ec373-6a6a-46e1-9c49-980d7cb0681f/4c30ad55-9b76-4af6-ba59-d14fead0b6b0/
http://clinitek.ru/wp-content/themes/spo.php
https://dentamasmulia.com/paymentupdate/Spotify-Login/
https://dentamasmulia.com/paymentupdate/Spotify-Login/signin.php?verify_account=session1097fbc4b278d8489e1d584b014d76b2&lim_session=7edace115a1b57a8e63a4eb3b64230e30bceff88

4 KB
2 KB

224ms
223ms

Document
text/html

219.83.68.92
INDOSATM2-ID INDO...

General

Check archive.org

Show headers Download Go to

Full URL: https://dentamasmulia.com/paymentupdate/Spotify-Login/signin.php?verify_account=session1097fbc4b278d8489e1d584b014d76b2&lim_session=7edace115a1b57a8e63a4eb3b64230e30bceff88
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 219.83.68.92 Bandung, Indonesia, ASN4795 (INDOSATM2-ID INDOSATM2 ASN, ID),
Reverse DNS: gondolayu.idweb.host
Software: LiteSpeed / PHP/5.6.40
Resource Hash: b5ae870bbf62341ed33ab824da7de7b16705a6cd177a6ecc34cdc89520676158

Request headers

:method: GET
:authority: dentamasmulia.com
:scheme: https
:path: /paymentupdate/Spotify-Login/signin.php?verify_account=session1097fbc4b278d8489e1d584b014d76b2&lim_session=7edace115a1b57a8e63a4eb3b64230e30bceff88
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
accept-encoding: gzip, deflate, br
cookie: PHPSESSID=t05mr7c3q7dn31tk5h4bhcero7
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
x-powered-by: PHP/5.6.40
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
content-type: text/html; charset=UTF-8
content-length: 1662
content-encoding: gzip
vary: Accept-Encoding
date: Sun, 27 Oct 2019 15:09:30 GMT
accept-ranges: bytes
server: LiteSpeed
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"

Redirect headers

status: 302
x-powered-by: PHP/5.6.40
set-cookie: PHPSESSID=t05mr7c3q7dn31tk5h4bhcero7; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
location: ./signin.php?verify_account=session1097fbc4b278d8489e1d584b014d76b2&lim_session=7edace115a1b57a8e63a4eb3b64230e30bceff88
content-type: text/html; charset=UTF-8
content-length: 0
date: Sun, 27 Oct 2019 15:09:30 GMT
accept-ranges: bytes
server: LiteSpeed
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"

GET
H/1.1 200
OK index.815c601ede0bda3f6d4b.css
accounts.scdn.co/css/ 280 KB
49 KB 21ms
6ms Stylesheet
text/css 151.101.12.246
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://accounts.scdn.co/css/index.815c601ede0bda3f6d4b.css
Requested by: Host: dentamasmulia.com
URL: https://dentamasmulia.com/paymentupdate/Spotify-Login/signin.php?verify_account=session1097fbc4b278d8489e1d584b014d76b2&lim_session=7edace115a1b57a8e63a4eb3b64230e30bceff88
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.246 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: /
Resource Hash: 48de22287159c16b74c7cfd12421abfef4a284848129434aa1805a1a9acf0f40

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://dentamasmulia.com/paymentupdate/Spotify-Login/signin.php?verify_account=session1097fbc4b278d8489e1d584b014d76b2&lim_session=7edace115a1b57a8e63a4eb3b64230e30bceff88
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 27 Oct 2019 15:09:30 GMT
Content-Encoding: gzip
Last-Modified: Wed, 06 Mar 2019 10:24:23 GMT
Age: 2187253
x-amz-meta-goog-reserved-file-mtime: 1551867855
ETag: "cef7c640274beae0e4bb740e11be8ee3"
X-Served-By: cache-ord1724-ORD, cache-fra19164-FRA
X-Cache: HIT, HIT
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000, no-transform
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 49311
X-Cache-Hits: 1, 1

GET
H2 200 recaptcha__fr.js Show response
www.gstatic.com/recaptcha/api2/v1550471573786/ 267 KB
92 KB 19ms
6ms Script
text/javascript 2a00:1450:4001:800::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/api2/v1550471573786/recaptcha__fr.js

Requested by

Host: dentamasmulia.com
URL: https://dentamasmulia.com/paymentupdate/Spotify-Login/signin.php?verify_account=session1097fbc4b278d8489e1d584b014d76b2&lim_session=7edace115a1b57a8e63a4eb3b64230e30bceff88

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

33ee87a929fefee2252351b2a6196f14cfa823f49386f572e5a0110a8ba45796

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://dentamasmulia.com/paymentupdate/Spotify-Login/signin.php?verify_account=session1097fbc4b278d8489e1d584b014d76b2&lim_session=7edace115a1b57a8e63a4eb3b64230e30bceff88
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 23 Oct 2019 23:45:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 19 Feb 2019 17:15:00 GMT
server: sffe
age: 314617
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 93471
x-xss-protection: 0
expires: Thu, 22 Oct 2020 23:45:53 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
18 KB 17ms
6ms Script
text/javascript 2a00:1450:4001:819::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://dentamasmulia.com/paymentupdate/Spotify-Login/signin.php?verify_account=session1097fbc4b278d8489e1d584b014d76b2&lim_session=7edace115a1b57a8e63a4eb3b64230e30bceff88
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 5696
date: Sun, 27 Oct 2019 13:34:34 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17803
expires: Sun, 27 Oct 2019 15:34:34 GMT

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f771fe217119432dbcdb59fe3d3ac37547eadd1a118d1646011d1d7ba7e053bf

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H/1.1 200
OK circular-black.woff2
sp-bootstrap.global.ssl.fastly.net/8.3.0/fonts/ 72 KB
73 KB 28ms
7ms Font
application/font-woff 151.101.13.194
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://sp-bootstrap.global.ssl.fastly.net/8.3.0/fonts/circular-black.woff2
Requested by: Host: dentamasmulia.com
URL: https://dentamasmulia.com/paymentupdate/Spotify-Login/signin.php?verify_account=session1097fbc4b278d8489e1d584b014d76b2&lim_session=7edace115a1b57a8e63a4eb3b64230e30bceff88
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d77456e48416e475066a580b2050cee4f86a3819556d0ddf90d81250f3af9de2

Request headers

Sec-Fetch-Mode: cors
Referer: https://accounts.scdn.co/css/index.815c601ede0bda3f6d4b.css
Origin: https://dentamasmulia.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: n2n0PHOBiiVBgFLAxNq59l9fb8Ux16k2
Via: 1.1 varnish, 1.1 varnish
ETag: "56b510f616f840ffde8f3955349a6c5a"
Age: 30502602
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 73892
x-amz-id-2: BHXW9ECRRthZQnJhdeZw10dXS/A1L/Ns6iaYgBMALuJxyskAnQVWxLBVW9kEnW5ZNYQ76/IAELs=
X-Served-By: cache-iad2143-IAD, cache-fra19134-FRA
Last-Modified: Wed, 07 Nov 2018 20:05:04 GMT
Server: AmazonS3
X-Timer: S1572188970.458291,VS0,VE0
Date: Sun, 27 Oct 2019 15:09:30 GMT
x-amz-request-id: 20BD888AC2000105
Access-Control-Allow-Origin: *
Expires: Thu, 07 Nov 2019 20:05:01 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Type: application/font-woff
X-Cache-Hits: 1, 4439

GET
H/1.1 200
OK circular-book.woff2
sp-bootstrap.global.ssl.fastly.net/8.3.0/fonts/ 68 KB
69 KB 26ms
7ms Font
application/font-woff 151.101.13.194
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://sp-bootstrap.global.ssl.fastly.net/8.3.0/fonts/circular-book.woff2
Requested by: Host: dentamasmulia.com
URL: https://dentamasmulia.com/paymentupdate/Spotify-Login/signin.php?verify_account=session1097fbc4b278d8489e1d584b014d76b2&lim_session=7edace115a1b57a8e63a4eb3b64230e30bceff88
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6384070e855e2ec15caefb6334ab2c4b1b9e798ce2e369cc00f0d47a41138e0d

Request headers

Sec-Fetch-Mode: cors
Referer: https://accounts.scdn.co/css/index.815c601ede0bda3f6d4b.css
Origin: https://dentamasmulia.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: o1AvH5CGNm247_bmaIQAXJEkRHjz530A
Via: 1.1 varnish, 1.1 varnish
ETag: "c4f753e765823b94234e7f5ccd733f44"
Age: 3445431
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 70092
x-amz-id-2: ECVtvV3TNaURyh5pO6fQQNzz6bF57DqQZWeRFbkgjybTF9iHmgyltKZ7fA7N9X0k32Tcp7Il5aE=
X-Served-By: cache-iad2124-IAD, cache-fra19123-FRA
Last-Modified: Wed, 07 Nov 2018 20:05:04 GMT
Server: AmazonS3
X-Timer: S1572188970.458376,VS0,VE0
Date: Sun, 27 Oct 2019 15:09:30 GMT
x-amz-request-id: FE6221F0CD1CA39D
Access-Control-Allow-Origin: *
Expires: Thu, 07 Nov 2019 20:05:01 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Type: application/font-woff
X-Cache-Hits: 2, 1442

GET
H/1.1 200
OK circular-bold.woff2
sp-bootstrap.global.ssl.fastly.net/8.3.0/fonts/ 74 KB
74 KB 25ms
6ms Font
application/font-woff 151.101.13.194
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://sp-bootstrap.global.ssl.fastly.net/8.3.0/fonts/circular-bold.woff2
Requested by: Host: dentamasmulia.com
URL: https://dentamasmulia.com/paymentupdate/Spotify-Login/signin.php?verify_account=session1097fbc4b278d8489e1d584b014d76b2&lim_session=7edace115a1b57a8e63a4eb3b64230e30bceff88
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: fdf0e3938479eb6e108e7869436051b7072b9a18ecb98b3c6b49d1b29d8bc758

Request headers

Sec-Fetch-Mode: cors
Referer: https://accounts.scdn.co/css/index.815c601ede0bda3f6d4b.css
Origin: https://dentamasmulia.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: .VL10jkIoNCaQuGQO9rGeMBxyEaBgBz4
Via: 1.1 varnish, 1.1 varnish
ETag: "c094813cfe6be5d188f4e506b6ffca1b"
Age: 4098109
X-Cache: MISS, HIT
Connection: keep-alive
Content-Length: 75488
x-amz-id-2: 78uWAbZB0jUrUuMDjpYFfm8PguOm6s7C3NA93YvGJWgAahp4nBkrJymFNZbsZuwqqWTxhaIi32s=
X-Served-By: cache-iad2146-IAD, cache-fra19137-FRA
Last-Modified: Wed, 07 Nov 2018 20:05:04 GMT
Server: AmazonS3
X-Timer: S1572188970.456793,VS0,VE0
Date: Sun, 27 Oct 2019 15:09:30 GMT
x-amz-request-id: 3D53DAC9A70A9193
Access-Control-Allow-Origin: *
Expires: Thu, 07 Nov 2019 20:05:01 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Type: application/font-woff
X-Cache-Hits: 0, 1418

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Spotify (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			dentamasmulia.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: t05mr7c3q7dn31tk5h4bhcero7

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.scdn.co
clinitek.ru
dentamasmulia.com
sp-bootstrap.global.ssl.fastly.net
spoteam.msnd1.com
www.google-analytics.com
www.gstatic.com
151.101.12.246
151.101.13.194
212.32.243.39
217.23.132.84
219.83.68.92
2a00:1450:4001:800::2003
2a00:1450:4001:819::200e
33ee87a929fefee2252351b2a6196f14cfa823f49386f572e5a0110a8ba45796
48de22287159c16b74c7cfd12421abfef4a284848129434aa1805a1a9acf0f40
6384070e855e2ec15caefb6334ab2c4b1b9e798ce2e369cc00f0d47a41138e0d
b5ae870bbf62341ed33ab824da7de7b16705a6cd177a6ecc34cdc89520676158
d77456e48416e475066a580b2050cee4f86a3819556d0ddf90d81250f3af9de2
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
f771fe217119432dbcdb59fe3d3ac37547eadd1a118d1646011d1d7ba7e053bf
fdf0e3938479eb6e108e7869436051b7072b9a18ecb98b3c6b49d1b29d8bc758

dentamasmulia.com Open in urlscan Pro 219.83.68.92 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

29 %IPv6

7 Domains

7 Subdomains

6 IPs

4 Countries

376 kBTransfer

813 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

1 Cookies

Indicators

dentamasmulia.com Open in urlscan Pro
219.83.68.92 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

29 %
IPv6

7
Domains

7
Subdomains

6
IPs

4
Countries

376 kB
Transfer

813 kB
Size

1
Cookies

7 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!