javva.koentjian.lol Open in urlscan Pro
172.67.176.98 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://javva.koentjian.lol/?beringasmen=colatogel
Submission Tags: @phish_report
Submission: On December 24 via api (December 24th 2024, 11:02:45 pm UTC) from FI — Scanned from FI

Summary HTTP 8 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 5 domains to perform 8 HTTP transactions. The main IP is 172.67.176.98, located in United States and belongs to CLOUDFLARENET, US. The main domain is javva.koentjian.lol.
TLS certificate: Issued by WE1 on December 16th 2024. Valid for: 3 months.

This is the only time javva.koentjian.lol was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	172.67.176.98 172.67.176.98	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	65.21.74.205 65.21.74.205	24940 (HETZNER-A...) (HETZNER-AS Hetzner Online GmbH)
8	3

1 172.67.176.98 (United States)

ASN13335 (CLOUDFLARENET, US)

javva.koentjian.lol	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 65.21.74.205 (Helsinki, Finland)

ASN24940 (HETZNER-AS Hetzner Online GmbH, DE)
PTR: static.205.74.21.65.clients.your-server.de

s11.gifyu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	gifyu.com s11.gifyu.com — Cisco Umbrella Rank: 292725	23 KB
1	koentjian.lol javva.koentjian.lol	4 KB
0	giphy.com Failed i.giphy.com Failed
0	googleapis.com Failed fonts.googleapis.com Failed
0	ampproject.org Failed cdn.ampproject.org Failed
8	5

	Domain	Requested by
4	s11.gifyu.com	javva.koentjian.lol
1	javva.koentjian.lol
0	i.giphy.com Failed	javva.koentjian.lol
0	fonts.googleapis.com Failed	javva.koentjian.lol
0	cdn.ampproject.org Failed	javva.koentjian.lol
8	5

This site contains links to these domains. Also see Links.

Domain
bantingsetir.art

Subject Issuer	Validity	Valid
koentjian.lol WE1	`2024-12-16` - `2025-03-16`	3 months	crt.sh
s11.gifyu.com R10	`2024-11-25` - `2025-02-23`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://javva.koentjian.lol/?beringasmen=colatogel
Frame ID: D9AE65167CA9CCA0CF3CB27D1D3389BB
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login Absensi Pegawai RSD MANGUSADA

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

8
Requests

63 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

3
IPs

2
Countries

27 kB
Transfer

36 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://bantingsetir.art/1

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response javva.koentjian.lol/	14 KB 4 KB	2918ms 483ms	Document text/html	172.67.176.98 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://javva.koentjian.lol/?beringasmen=colatogel Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.176.98 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `53b6ca393961fa1944ed64c93316ced5ee19e96f9230b6b22f011f7316a818ec` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8f7437ca1dd5eb4d-CPH content-encoding zstd content-type text/html date Tue, 24 Dec 2024 23:02:15 GMT last-modified Sat, 21 Dec 2024 17:58:17 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WbwVZeZAL%2F1GT1ZyNoEDIfFqKYD4YUMxtqQrWlcrf5MWnlEtTpndFu0ECanUuwpEv%2B3mS6fuY3tYRT5MAP%2BptpUWo9qt1lwaCenZTNnwzZqX1V3jqK1AtWjwwp7iaCiRRIqdsSXo"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=TCP&rtt=43060&min_rtt=39663&rtt_var=17445&sent=12&recv=10&lost=0&retrans=4&sent_bytes=9501&recv_bytes=2309&delivery_rate=23426&cwnd=252&unsent_bytes=0&cid=60d7224cb0ac9ac2&ts=780&x=0" vary Accept-Encoding
GET		v0.js cdn.ampproject.org/	0 0

GET		css2 fonts.googleapis.com/	0 0

GET H2	200	SyhZO.png s11.gifyu.com/images/	5 KB 5 KB	27363ms 16375ms	Image image/png	65.21.74.205 HETZNER-AS Hetzne...
General Check archive.org Show headers Download Go to Show image Full URL https://s11.gifyu.com/images/SyhZO.png Requested by Host: javva.koentjian.lol URL: https://javva.koentjian.lol/?beringasmen=colatogel Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.21.74.205 Helsinki, Finland, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE), Reverse DNS static.205.74.21.65.clients.your-server.de Software nginx/1.18.0 (Ubuntu) / Resource Hash `eda0b47e64bebe25ecdc7a33ca1fef3560c2478c4cc4baf776a6a17fc962b6ad` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://javva.koentjian.lol/ Response headers accept-ranges bytes content-length 4869 date Tue, 24 Dec 2024 23:02:35 GMT etag "672cb110-1305" content-type image/png last-modified Thu, 07 Nov 2024 12:22:40 GMT server nginx/1.18.0 (Ubuntu)
GET H2	200	SyhZB.png s11.gifyu.com/images/	4 KB 4 KB	27176ms 16188ms	Image image/png	65.21.74.205 HETZNER-AS Hetzne...
General Check archive.org Show headers Download Go to Show image Full URL https://s11.gifyu.com/images/SyhZB.png Requested by Host: javva.koentjian.lol URL: https://javva.koentjian.lol/?beringasmen=colatogel Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.21.74.205 Helsinki, Finland, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE), Reverse DNS static.205.74.21.65.clients.your-server.de Software nginx/1.18.0 (Ubuntu) / Resource Hash `94bfec52c757c42fbffa1d4b8fbcef0f63a148605871d8d9ffe1636009ed2f0e` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://javva.koentjian.lol/ Response headers accept-ranges bytes content-length 4441 date Tue, 24 Dec 2024 23:02:35 GMT etag "672cb110-1159" content-type image/png last-modified Thu, 07 Nov 2024 12:22:40 GMT server nginx/1.18.0 (Ubuntu)
GET H2	200	SyhZy.png s11.gifyu.com/images/	8 KB 8 KB	27071ms 16084ms	Image image/png	65.21.74.205 HETZNER-AS Hetzne...
General Check archive.org Show headers Download Go to Show image Full URL https://s11.gifyu.com/images/SyhZy.png Requested by Host: javva.koentjian.lol URL: https://javva.koentjian.lol/?beringasmen=colatogel Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.21.74.205 Helsinki, Finland, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE), Reverse DNS static.205.74.21.65.clients.your-server.de Software nginx/1.18.0 (Ubuntu) / Resource Hash `f3482e3e3a37655b4b577c1d211ccf210a53633432e7506fcd3c2f39c1108588` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://javva.koentjian.lol/ Response headers accept-ranges bytes content-length 8165 date Tue, 24 Dec 2024 23:02:35 GMT etag "672cb110-1fe5" content-type image/png last-modified Thu, 07 Nov 2024 12:22:40 GMT server nginx/1.18.0 (Ubuntu)
GET H2	200	SyhZG.png s11.gifyu.com/images/	5 KB 5 KB	22011ms 11023ms	Image image/png	65.21.74.205 HETZNER-AS Hetzne...
General Check archive.org Show headers Download Go to Show image Full URL https://s11.gifyu.com/images/SyhZG.png Requested by Host: javva.koentjian.lol URL: https://javva.koentjian.lol/?beringasmen=colatogel Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.21.74.205 Helsinki, Finland, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE), Reverse DNS static.205.74.21.65.clients.your-server.de Software nginx/1.18.0 (Ubuntu) / Resource Hash `a191ebfab47c1982b4ab1a41ac6e3636939395b6677a176a317a44d7dab5805e` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://javva.koentjian.lol/ Response headers accept-ranges bytes content-length 5278 date Tue, 24 Dec 2024 23:02:35 GMT etag "672cb110-149e" content-type image/png last-modified Thu, 07 Nov 2024 12:22:40 GMT server nginx/1.18.0 (Ubuntu)
GET		giphy.gif i.giphy.com/media/v1.Y2lkPTc5MGI3NjExZWtiNTVpazk5ZmlkcjBkNzNsbDZ4bzd2bmVrN2UwNWJlZW9tcXB1bSZlcD12MV9pbnRlcm5hbF9naWZfYnlfaWQmY3Q9Zw/U3qYN8S0j3bpK/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Domain: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Noto+Sans:wght@400;700&display=swap

Domain: i.giphy.com
URL: https://i.giphy.com/media/v1.Y2lkPTc5MGI3NjExZWtiNTVpazk5ZmlkcjBkNzNsbDZ4bzd2bmVrN2UwNWJlZW9tcXB1bSZlcD12MV9pbnRlcm5hbF9naWZfYnlfaWQmY3Q9Zw/U3qYN8S0j3bpK/giphy.gif

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://fonts.googleapis.com/css2?family=Noto+Sans:wght@400;700&display=swap Message: Failed to load resource: net::ERR_CONNECTION_CLOSED
network	error	URL: https://cdn.ampproject.org/v0.js Message: Failed to load resource: net::ERR_SOCKET_NOT_CONNECTED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.ampproject.org
fonts.googleapis.com
i.giphy.com
javva.koentjian.lol
s11.gifyu.com
cdn.ampproject.org
fonts.googleapis.com
i.giphy.com
172.67.176.98
65.21.74.205
53b6ca393961fa1944ed64c93316ced5ee19e96f9230b6b22f011f7316a818ec
94bfec52c757c42fbffa1d4b8fbcef0f63a148605871d8d9ffe1636009ed2f0e
a191ebfab47c1982b4ab1a41ac6e3636939395b6677a176a317a44d7dab5805e
eda0b47e64bebe25ecdc7a33ca1fef3560c2478c4cc4baf776a6a17fc962b6ad
f3482e3e3a37655b4b577c1d211ccf210a53633432e7506fcd3c2f39c1108588

javva.koentjian.lol Open in urlscan Pro 172.67.176.98 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

8 Requests

63 %HTTPS

0 %IPv6

5 Domains

5 Subdomains

3 IPs

2 Countries

27 kBTransfer

36 kBSize

0 Cookies

1 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

javva.koentjian.lol Open in urlscan Pro
172.67.176.98 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

63 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

3
IPs

2
Countries

27 kB
Transfer

36 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions