chesrae.com Open in urlscan Pro
194.124.216.101 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://chesrae.com/
Submission Tags: tweet @atomspam #phishing #chase #infosec #cybersecurity #atomspam Search All
Submission: On April 07 via api (April 7th 2023, 2:10:59 am UTC) from FI — Scanned from NL

Summary HTTP 20 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 4 countries across 3 domains to perform 20 HTTP transactions. The main IP is 194.124.216.101, located in Amsterdam, Netherlands and belongs to XTOM xTom GmbH, DE. The main domain is chesrae.com.
TLS certificate: Issued by R3 on April 5th 2023. Valid for: 3 months.

This is the only time chesrae.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Chase (Banking)

Domain & IP information

	IP Address	AS Autonomous System
9	194.124.216.101 194.124.216.101	3214 (XTOM xTom...) (XTOM xTom GmbH)
1	47.253.50.2 47.253.50.2	45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.)
1	103.143.19.103 103.143.19.103	134760 (CHINANET-...) (CHINANET-HEBEI-SHIJIAZHUANG-IDC Shijiazhuang IDC network)
9	23.36.162.218 23.36.162.218	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
20	4

9 194.124.216.101 (Amsterdam, Netherlands)

ASN3214 (XTOM xTom GmbH, DE)
PTR: 194.124.216.101.static.xtom.com

chesrae.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 47.253.50.2 (United States)

ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)

sdk.51.la	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 103.143.19.103 (China)

ASN134760 (CHINANET-HEBEI-SHIJIAZHUANG-IDC Shijiazhuang IDC network, CHINANET Hebei province, CN)

collect-v6.51.la	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 23.36.162.218 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-36-162-218.deploy.static.akamaitechnologies.com

static.chasecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	chasecdn.com static.chasecdn.com — Cisco Umbrella Rank: 9852	464 KB
9	chesrae.com chesrae.com	246 KB
2	51.la sdk.51.la — Cisco Umbrella Rank: 50464 collect-v6.51.la — Cisco Umbrella Rank: 46123	13 KB
20	3

	Domain	Requested by
9	static.chasecdn.com	chesrae.com static.chasecdn.com
9	chesrae.com	chesrae.com
1	collect-v6.51.la	sdk.51.la
1	sdk.51.la	chesrae.com
20	4

This site contains no links.

Subject Issuer	Validity	Valid
chesrae.com R3	`2023-04-05` - `2023-07-04`	3 months	crt.sh
*.51.la GlobalSign GCC R3 DV TLS CA 2020	`2022-04-19` - `2023-05-21`	a year	crt.sh
static.chasecdn.com Entrust Certification Authority - L1M	`2022-09-09` - `2023-09-09`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://chesrae.com/
Frame ID: 2212B68F0AD47EC7376D22FB7586BF88
Requests: 9 HTTP requests in this frame

Frame: https://chesrae.com/ch/saved_resource.asp
Frame ID: 8EC1C3A5EA4776ACCFD1D2E1A137947D
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in - chase.com

Detected technologies

ZURB Foundation (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+foundation[^>"]+css

Page Statistics

20
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

4
IPs

4
Countries

723 kB
Transfer

2483 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
chesrae.com/ 12 KB
3 KB 60ms
19ms Document
text/html 194.124.216.101
XTOM xTom GmbH

General

Check archive.org

Show headers Download Go to

Full URL: https://chesrae.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.124.216.101 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS: 194.124.216.101.static.xtom.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 2d203fbf2d83940535b46b251908d1d7382e35cece779ec01dc897dda40fd8c6

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

cache-control: private
content-encoding: gzip
content-length: 3401
content-type: text/html
date: Fri, 07 Apr 2023 02:10:53 GMT
server: Microsoft-IIS/10.0
vary: Accept-Encoding
x-powered-by: ASP.NET

GET
H/1.1 200
OK js-sdk-pro.min.js Show response
sdk.51.la/ 34 KB
13 KB 407ms
198ms Script
application/javascript 47.253.50.2
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.51.la/js-sdk-pro.min.js
Requested by: Host: chesrae.com
URL: https://chesrae.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 47.253.50.2 , United States, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: openresty /
Resource Hash: d1f1bfe698f2ffb7b3e7a885a301d58f9554d45df0a31c3e8b53c84b33c80d27

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://chesrae.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 02:10:53 GMT
Content-Encoding: gzip
Last-Modified: Tue, 10 Jan 2023 04:34:55 GMT
Server: openresty
ETag: W/"63bceaef-861a"
Transfer-Encoding: chunked
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=1296000
Access-Control-Allow-Credentials: true
Connection: keep-alive

GET
H2 200 L5RKQ-XSSA6-NWWJL-KYB8W-GG7QR Show response
chesrae.com/ch/ 205 KB
58 KB 56ms
55ms Script
text/plain 194.124.216.101
XTOM xTom GmbH

General

Check archive.org

Show headers Download Go to

Full URL: https://chesrae.com/ch/L5RKQ-XSSA6-NWWJL-KYB8W-GG7QR
Requested by: Host: chesrae.com
URL: https://chesrae.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.124.216.101 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS: 194.124.216.101.static.xtom.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://chesrae.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:10:53 GMT
content-encoding: gzip
last-modified: Tue, 28 Mar 2023 12:16:10 GMT
server: Microsoft-IIS/10.0
etag: "0a1a8146f61d91:0"
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/plain
accept-ranges: bytes
content-length: 59129

GET
H2 200 MdsFoundation-cpo.css
chesrae.com/ch/ 24 KB
3 KB 15ms
14ms Stylesheet
text/css 194.124.216.101
XTOM xTom GmbH

General

Check archive.org

Show headers Download Go to

Full URL: https://chesrae.com/ch/MdsFoundation-cpo.css
Requested by: Host: chesrae.com
URL: https://chesrae.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.124.216.101 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS: 194.124.216.101.static.xtom.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: a0905361770ff921188a807f2800d2b991ca584be7ef0cf3d3b7d937bacb3214

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://chesrae.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:10:53 GMT
content-encoding: gzip
last-modified: Tue, 28 Mar 2023 12:16:16 GMT
server: Microsoft-IIS/10.0
etag: "0283c186f61d91:0"
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 3449

GET
H2 200 MdsComponents-cpo.css
chesrae.com/ch/ 345 KB
38 KB 28ms
27ms Stylesheet
text/css 194.124.216.101
XTOM xTom GmbH

General

Check archive.org

Show headers Download Go to

Full URL: https://chesrae.com/ch/MdsComponents-cpo.css
Requested by: Host: chesrae.com
URL: https://chesrae.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.124.216.101 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS: 194.124.216.101.static.xtom.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e675ad7e428e6b832990d9d3e5c1374908cf5a41d2945afbe7b067f9ab9150e3

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://chesrae.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:10:53 GMT
content-encoding: gzip
last-modified: Tue, 28 Mar 2023 12:16:16 GMT
server: Microsoft-IIS/10.0
etag: "0283c186f61d91:0"
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 39199

GET
H2 200 logon.css
chesrae.com/ch/ 108 KB
16 KB 41ms
41ms Stylesheet
text/css 194.124.216.101
XTOM xTom GmbH

General

Check archive.org

Show headers Download Go to

Full URL: https://chesrae.com/ch/logon.css
Requested by: Host: chesrae.com
URL: https://chesrae.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.124.216.101 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS: 194.124.216.101.static.xtom.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: a01ec70d4eff053dc133efed8e52786a5de87e1852176b489d17ada479c156b8

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://chesrae.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:10:53 GMT
content-encoding: gzip
last-modified: Wed, 29 Mar 2023 12:36:06 GMT
server: Microsoft-IIS/10.0
etag: "07ff173b62d91:0"
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 16578

GET
H2 200 blue-ui.css
chesrae.com/ch/ 498 KB
59 KB 45ms
44ms Stylesheet
text/css 194.124.216.101
XTOM xTom GmbH

General

Check archive.org

Show headers Download Go to

Full URL: https://chesrae.com/ch/blue-ui.css
Requested by: Host: chesrae.com
URL: https://chesrae.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.124.216.101 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS: 194.124.216.101.static.xtom.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 3303fd8e3e10ea99269b96fcffa1370d6e40a21f02a712920f875b04a91e3205

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://chesrae.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:10:53 GMT
content-encoding: gzip
last-modified: Tue, 28 Mar 2023 12:16:10 GMT
server: Microsoft-IIS/10.0
etag: "0a1a8146f61d91:0"
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 60261

POST
H/1.1 200 collect Show response
collect-v6.51.la/v6/ 0
394 B 1359ms
278ms XHR
text/plain 103.143.19.103
CHINANET-HEBEI-SH...

General

Check archive.org

Show headers Download Go to

Full URL: https://collect-v6.51.la/v6/collect?dt=4
Requested by: Host: sdk.51.la
URL: https://sdk.51.la/js-sdk-pro.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 103.143.19.103 , China, ASN134760 (CHINANET-HEBEI-SHIJIAZHUANG-IDC Shijiazhuang IDC network, CHINANET Hebei province, CN),
Reverse DNS
Software: CloudWAF /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://chesrae.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://chesrae.com
Date: Fri, 07 Apr 2023 02:10:55 GMT
Access-Control-Allow-Credentials: true
Server: CloudWAF
Connection: keep-alive
Content-Length: 0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

GET
H2 200 saved_resource.asp Show response
chesrae.com/ch/ Frame 8EC1 20 KB
5 KB 17ms
17ms Document
text/html 194.124.216.101
XTOM xTom GmbH

General

Check archive.org

Show headers Download Go to

Full URL: https://chesrae.com/ch/saved_resource.asp
Requested by: Host: chesrae.com
URL: https://chesrae.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.124.216.101 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS: 194.124.216.101.static.xtom.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: f68fd90764649edaefba674b966a961a2470d6701bd7e409ed7df1b881953675

Request headers

Referer: https://chesrae.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

cache-control: private
content-encoding: gzip
content-length: 5122
content-type: text/html
date: Fri, 07 Apr 2023 02:10:53 GMT
server: Microsoft-IIS/10.0
vary: Accept-Encoding
x-powered-by: ASP.NET

GET
H2 200 opensans-regular.woff
static.chasecdn.com/content/dam/cpo-static/fonts/ 24 KB
25 KB 285ms
25ms Font
font/woff 23.36.162.218
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://static.chasecdn.com/content/dam/cpo-static/fonts/opensans-regular.woff

Requested by

Host: chesrae.com
URL: https://chesrae.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.162.218 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-36-162-218.deploy.static.akamaitechnologies.com

Software

Resource Hash

b8422277fc69c8e6ab51112dbf25048e40425cc497490fee251b56d7ef0ca179

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; preload

Request headers

Referer: https://chesrae.com/
Origin: https://chesrae.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:10:54 GMT
strict-transport-security: max-age=86400 ; preload
last-modified: Tue, 28 Mar 2023 01:44:02 GMT
x-amzn-trace-id: 0.dad5ce17.1680833454.206edcbb
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=2592000,s-maxage=2592000
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="466898_399431130_544136379_17_5317_19_0";dur=1
accept-ranges: bytes
content-length: 24876

GET
H2 200 mds-chase-icons.css
chesrae.com/ch/ Frame 8EC1 25 KB
5 KB 15ms
14ms Stylesheet
text/css 194.124.216.101
XTOM xTom GmbH

General

Check archive.org

Show headers Download Go to

Full URL: https://chesrae.com/ch/mds-chase-icons.css
Requested by: Host: chesrae.com
URL: https://chesrae.com/ch/saved_resource.asp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.124.216.101 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS: 194.124.216.101.static.xtom.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: d5dc1e864e5ef335e96dee19fba2c93a8e9fcdbe06f97229e1cdbdbaffc93f33

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://chesrae.com/ch/saved_resource.asp
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:10:53 GMT
content-encoding: gzip
last-modified: Tue, 28 Mar 2023 12:16:10 GMT
server: Microsoft-IIS/10.0
etag: "0a1a8146f61d91:0"
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 4820

GET
H2 200 logon.css
static.chasecdn.com/web/library/@seur/logon-app/23.11.03/logon/assets/ Frame 8EC1 108 KB
14 KB 270ms
45ms Stylesheet
text/css 23.36.162.218
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://static.chasecdn.com/web/library/@seur/logon-app/23.11.03/logon/assets/logon.css

Requested by

Host: chesrae.com
URL: https://chesrae.com/ch/saved_resource.asp

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.162.218 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-36-162-218.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

76faa3c5ac7350f60d4ea198c89382fcd1cff4401eff0c08ea6e447dad2d5ded

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=86400 ; preload
X-Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://chesrae.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-content-security-policy: frame-ancestors 'none'
content-security-policy: frame-ancestors 'none'
content-encoding: br
x-content-type-options: nosniff
date: Fri, 07 Apr 2023 02:10:54 GMT
strict-transport-security: max-age=86400 ; preload
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="466898_399431130_544136383_24_4921_18_0";dur=1
content-length: 14190
x-xss-protection: 1; mode=block
x-trace-id: ZBzO8qvlWqtm-sPqbZuOwAAAAGA
last-modified: Wed, 29 Mar 2023 01:16:16 GMT
server: Akamai Resource Optimizer
etag: "1b0b7-5f6f4670e5940"
x-amzn-trace-id: 0.c4bec217.1680052574.da50f49, 0.dad5ce17.1680833454.206edcbf
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Mar 2024 01:16:15 GMT

GET
H2 200 blue-ui.css
static.chasecdn.com/web/library/@seur/cxo-common-assets/1.0.4/dist/common/assets/ Frame 8EC1 498 KB
44 KB 250ms
26ms Stylesheet
text/css 23.36.162.218
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://static.chasecdn.com/web/library/@seur/cxo-common-assets/1.0.4/dist/common/assets/blue-ui.css

Requested by

Host: chesrae.com
URL: https://chesrae.com/ch/saved_resource.asp

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.162.218 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-36-162-218.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

3303fd8e3e10ea99269b96fcffa1370d6e40a21f02a712920f875b04a91e3205

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=86400 ; preload
X-Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://chesrae.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-content-security-policy: frame-ancestors 'none'
content-security-policy: frame-ancestors 'none'
content-encoding: br
x-content-type-options: nosniff
date: Fri, 07 Apr 2023 02:10:54 GMT
strict-transport-security: max-age=86400 ; preload
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="466898_399431130_544136384_19_4838_18_0";dur=1
content-length: 44646
x-xss-protection: 1; mode=block
x-trace-id: ZCOSyNb430GLAHNzvR_gTQAAALk
last-modified: Wed, 29 Mar 2023 01:25:47 GMT
server: Akamai Resource Optimizer
etag: "7c8f3-5db121f070000"
x-amzn-trace-id: 0.c4bec217.1680053145.db9ed09, 0.dad5ce17.1680833454.206edcc0
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Mar 2024 01:22:16 GMT

GET
H2 200 L5RKQ-XSSA6-NWWJL-KYB8W-GG7QR Show response
chesrae.com/ch/ Frame 8EC1 205 KB
58 KB 17ms
17ms Script
text/plain 194.124.216.101
XTOM xTom GmbH

General

Check archive.org

Show headers Download Go to

Full URL: https://chesrae.com/ch/L5RKQ-XSSA6-NWWJL-KYB8W-GG7QR
Requested by: Host: chesrae.com
URL: https://chesrae.com/ch/saved_resource.asp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.124.216.101 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS: 194.124.216.101.static.xtom.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://chesrae.com/ch/saved_resource.asp
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:10:53 GMT
content-encoding: gzip
last-modified: Tue, 28 Mar 2023 12:16:10 GMT
server: Microsoft-IIS/10.0
etag: "0a1a8146f61d91:0"
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/plain
accept-ranges: bytes
content-length: 59129

GET
H2 200 wordmark-white.svg
static.chasecdn.com/web/library/@seur/cxo-common-assets/1.0.4/dist/common/assets/img/logos/ Frame 8EC1 1 KB
1 KB 31ms
31ms Image
image/svg+xml 23.36.162.218
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.chasecdn.com/web/library/@seur/cxo-common-assets/1.0.4/dist/common/assets/img/logos/wordmark-white.svg

Requested by

Host: static.chasecdn.com
URL: https://static.chasecdn.com/web/library/@seur/logon-app/23.11.03/logon/assets/logon.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.162.218 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-36-162-218.deploy.static.akamaitechnologies.com

Software

Resource Hash

d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=86400 ; preload
X-Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://static.chasecdn.com/web/library/@seur/logon-app/23.11.03/logon/assets/logon.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

expires: Thu, 28 Mar 2024 10:52:43 GMT
content-security-policy: frame-ancestors 'none'
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 07 Apr 2023 02:10:54 GMT
strict-transport-security: max-age=86400 ; preload
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="466898_399431130_544136435_17_5909_19_0";dur=1
content-length: 645
x-xss-protection: 1; mode=block
x-trace-id: ZBIJC3Igngfjc79jfpk_pwAAATA
last-modified: Fri, 25 Mar 2022 22:02:50 GMT
etag: "581-5db121f9f9680"
x-amzn-trace-id: , 0.dad5ce17.1680833454.206edcf3
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-content-security-policy: frame-ancestors 'none'

GET
H2 200 background.desktop.night.1.jpeg
static.chasecdn.com/content/geo-images/images/ Frame 8EC1 245 KB
246 KB 26ms
26ms Image
image/jpeg 23.36.162.218
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.chasecdn.com/content/geo-images/images/background.desktop.night.1.jpeg

Requested by

Host: chesrae.com
URL: https://chesrae.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.162.218 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-36-162-218.deploy.static.akamaitechnologies.com

Software

Resource Hash

38e6598d39689b79c8b1d3ee5f56288db872835c66b19abe44056a13e34c8c64

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; preload

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://chesrae.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:10:54 GMT
strict-transport-security: max-age=86400 ; preload
last-modified: Tue, 22 Sep 2020 22:37:59 GMT
x-amzn-trace-id: , 0.dad5ce17.1680833454.206edcf4
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=2592000,s-maxage=2592000
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="466898_399431130_544136436_22_5796_19_0";dur=1
accept-ranges: bytes
content-length: 250869

GET
H2 200 opensans-regular.woff
static.chasecdn.com/content/dam/cpo-static/fonts/ Frame 8EC1 24 KB
25 KB 26ms
26ms Font
font/woff 23.36.162.218
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://static.chasecdn.com/content/dam/cpo-static/fonts/opensans-regular.woff

Requested by

Host: chesrae.com
URL: https://chesrae.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.162.218 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-36-162-218.deploy.static.akamaitechnologies.com

Software

Resource Hash

b8422277fc69c8e6ab51112dbf25048e40425cc497490fee251b56d7ef0ca179

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; preload

Request headers

Referer: https://chesrae.com/
Origin: https://chesrae.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:10:54 GMT
strict-transport-security: max-age=86400 ; preload
last-modified: Tue, 28 Mar 2023 01:44:02 GMT
x-amzn-trace-id: 0.dad5ce17.1680833454.206edcf5
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=2592000,s-maxage=2592000
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="466898_399431130_544136437_15_5597_20_0";dur=1
accept-ranges: bytes
content-length: 24876

GET
H2 200 opensans-bold.woff
static.chasecdn.com/content/dam/cpo-static/fonts/ Frame 8EC1 14 KB
14 KB 30ms
30ms Font
font/woff 23.36.162.218
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://static.chasecdn.com/content/dam/cpo-static/fonts/opensans-bold.woff

Requested by

Host: chesrae.com
URL: https://chesrae.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.162.218 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-36-162-218.deploy.static.akamaitechnologies.com

Software

Resource Hash

0634f735018d63980fb935914bd910ebd51ed5ed0a03c8811607aca0c2e7c532

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; preload

Request headers

Referer: https://chesrae.com/
Origin: https://chesrae.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:10:54 GMT
strict-transport-security: max-age=86400 ; preload
last-modified: Tue, 28 Mar 2023 18:39:48 GMT
x-amzn-trace-id: , 0.dad5ce17.1680833454.206edcf9
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=2592000,s-maxage=2592000
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="466898_399431130_544136441_33_4201_20_0";dur=1
accept-ranges: bytes
content-length: 14504

GET
H2 200 opensans-semibold.woff
static.chasecdn.com/content/dam/cpo-static/fonts/ Frame 8EC1 25 KB
25 KB 30ms
30ms Font
font/woff 23.36.162.218
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://static.chasecdn.com/content/dam/cpo-static/fonts/opensans-semibold.woff

Requested by

Host: chesrae.com
URL: https://chesrae.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.162.218 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-36-162-218.deploy.static.akamaitechnologies.com

Software

Resource Hash

d2113460c69de50edc6206a20deec3c2bc2733929f53817f1faca74ab34c33e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; preload

Request headers

Referer: https://chesrae.com/
Origin: https://chesrae.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 02:10:54 GMT
strict-transport-security: max-age=86400 ; preload
last-modified: Tue, 28 Mar 2023 11:08:04 GMT
x-amzn-trace-id: , 0.dad5ce17.1680833454.206edcfa
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=2592000,s-maxage=2592000
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="466898_399431130_544136442_34_4225_20_0";dur=1
accept-ranges: bytes
content-length: 25108

GET
H2 200 dcefont.woff
static.chasecdn.com/web/library/@seur/cxo-common-assets/1.0.4/dist/common/assets/fonts/ Frame 8EC1 69 KB
69 KB 33ms
33ms Font
font/woff 23.36.162.218
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://static.chasecdn.com/web/library/@seur/cxo-common-assets/1.0.4/dist/common/assets/fonts/dcefont.woff

Requested by

Host: static.chasecdn.com
URL: https://static.chasecdn.com/web/library/@seur/cxo-common-assets/1.0.4/dist/common/assets/blue-ui.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.162.218 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-36-162-218.deploy.static.akamaitechnologies.com

Software

Resource Hash

6ea71f4189e78297e3d1834c586a10dd39826ed8361cb1268b847cef45e03cb1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=86400 ; preload
X-Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://static.chasecdn.com/web/library/@seur/cxo-common-assets/1.0.4/dist/common/assets/blue-ui.css
Origin: https://chesrae.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

expires: Thu, 28 Mar 2024 04:14:09 GMT
content-security-policy: frame-ancestors 'none'
date: Fri, 07 Apr 2023 02:10:54 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=86400 ; preload
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="466898_399431130_544136443_35_4188_20_0";dur=1
content-length: 70296
x-xss-protection: 1; mode=block
x-trace-id: ZBjPJXJANZKkYLFMUnxF2wAAAAA
last-modified: Fri, 25 Mar 2022 22:02:51 GMT
etag: "11298-5db121faed8c0"
x-amzn-trace-id: 0.dad5ce17.1680833454.206edcfb
x-frame-options: DENY
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-content-security-policy: frame-ancestors 'none'

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Chase (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| LA number| laWaitTime

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
chesrae.com/	1969-12-31 23:59:59	Name: __vtins__JzBF000TQrWdfnEJ Value: %7B%22sid%22%3A%20%22abb9025d-1c39-5a54-a0fb-09b7162e88e2%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201680835253842%2C%20%22ct%22%3A%201680833453842%7D
chesrae.com/	1970-01-20 20:29:53	Name: __51uvsct__JzBF000TQrWdfnEJ Value: 1
chesrae.com/	1970-01-20 20:29:53	Name: __51vcke__JzBF000TQrWdfnEJ Value: b9929d9e-cbea-5e32-8523-55935e0cdd25
chesrae.com/	1970-01-20 20:29:53	Name: __51vuft__JzBF000TQrWdfnEJ Value: 1680833453845
chesrae.com/	1969-12-31 23:59:59	Name: ASPSESSIONIDQUQSQSAR Value: AECIIMBDMGANMMNBKHBACGNI

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://chesrae.com/ch/saved_resource.asp Message: The resource https://chesrae.com/ch/L5RKQ-XSSA6-NWWJL-KYB8W-GG7QR was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://chesrae.com/ Message: The resource https://chesrae.com/ch/L5RKQ-XSSA6-NWWJL-KYB8W-GG7QR was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

chesrae.com
collect-v6.51.la
sdk.51.la
static.chasecdn.com
103.143.19.103
194.124.216.101
23.36.162.218
47.253.50.2
0634f735018d63980fb935914bd910ebd51ed5ed0a03c8811607aca0c2e7c532
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4
2d203fbf2d83940535b46b251908d1d7382e35cece779ec01dc897dda40fd8c6
3303fd8e3e10ea99269b96fcffa1370d6e40a21f02a712920f875b04a91e3205
38e6598d39689b79c8b1d3ee5f56288db872835c66b19abe44056a13e34c8c64
6ea71f4189e78297e3d1834c586a10dd39826ed8361cb1268b847cef45e03cb1
76faa3c5ac7350f60d4ea198c89382fcd1cff4401eff0c08ea6e447dad2d5ded
a01ec70d4eff053dc133efed8e52786a5de87e1852176b489d17ada479c156b8
a0905361770ff921188a807f2800d2b991ca584be7ef0cf3d3b7d937bacb3214
b8422277fc69c8e6ab51112dbf25048e40425cc497490fee251b56d7ef0ca179
d1f1bfe698f2ffb7b3e7a885a301d58f9554d45df0a31c3e8b53c84b33c80d27
d2113460c69de50edc6206a20deec3c2bc2733929f53817f1faca74ab34c33e3
d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0
d5dc1e864e5ef335e96dee19fba2c93a8e9fcdbe06f97229e1cdbdbaffc93f33
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e675ad7e428e6b832990d9d3e5c1374908cf5a41d2945afbe7b067f9ab9150e3
f68fd90764649edaefba674b966a961a2470d6701bd7e409ed7df1b881953675

chesrae.com Open in urlscan Pro 194.124.216.101 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

20 Requests

100 %HTTPS

0 %IPv6

3 Domains

4 Subdomains

4 IPs

4 Countries

723 kBTransfer

2483 kBSize

5 Cookies

0 Outgoing links

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

5 Cookies

2 Console Messages

Indicators

chesrae.com Open in urlscan Pro
194.124.216.101 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

4
IPs

4
Countries

723 kB
Transfer

2483 kB
Size

5
Cookies

20 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!