safealerts-chase.com Open in urlscan Pro
198.54.115.38  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request signin.php Show response safealerts-chase.com/chase/home/	17 KB 5 KB	577ms 239ms	Document text/html	198.54.115.38 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://safealerts-chase.com/chase/home/signin.php?session=376531663232 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.115.38 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server220-2.web-hosting.com Software Apache / PHP/7.2.34 Resource Hash 73ac907e4c3e571d48958b57e8a8220bf680b06b924199c5ac0b1c004f5dd753 Request headers :method GET :authority safealerts-chase.com :scheme https :path /chase/home/signin.php?session=376531663232 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 23 Dec 2020 13:19:47 GMT server Apache x-powered-by PHP/7.2.34 vary Accept-Encoding content-encoding gzip content-length 4462 content-type text/html; charset=UTF-8
GET H2	200	blue-ui.css safealerts-chase.com/chase/home/style/css/	396 KB 50 KB	592ms 590ms	Stylesheet text/css	198.54.115.38 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://safealerts-chase.com/chase/home/style/css/blue-ui.css Requested by Host: safealerts-chase.com URL: https://safealerts-chase.com/chase/home/signin.php?session=376531663232 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.115.38 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server220-2.web-hosting.com Software Apache / Resource Hash a054554812c09bcd6e28618753061066ae6273f3af38e7cba62adeb7f1a5c348 Request headers Referer https://safealerts-chase.com/chase/home/signin.php?session=376531663232 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 23 Dec 2020 13:19:48 GMT content-encoding gzip last-modified Sat, 02 Jun 2018 21:32:42 GMT server Apache vary Accept-Encoding content-type text/css accept-ranges bytes content-length 51281
GET H2	200	logon.css safealerts-chase.com/chase/home/style/css/	128 KB 17 KB	449ms 447ms	Stylesheet text/css	198.54.115.38 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://safealerts-chase.com/chase/home/style/css/logon.css Requested by Host: safealerts-chase.com URL: https://safealerts-chase.com/chase/home/signin.php?session=376531663232 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.115.38 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server220-2.web-hosting.com Software Apache / Resource Hash beaf04b1508ee134c7053a40e11f0a70faad6ac2dabad8cf8d288a77193f10df Request headers Referer https://safealerts-chase.com/chase/home/signin.php?session=376531663232 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 23 Dec 2020 13:19:48 GMT content-encoding gzip last-modified Sat, 02 Jun 2018 20:29:48 GMT server Apache vary Accept-Encoding content-type text/css accept-ranges bytes content-length 17220
GET H2	200	srcen.min.js Show response safealerts-chase.com/chase/home/style/js/	56 KB 19 KB	307ms 306ms	Script application/javascript	198.54.115.38 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://safealerts-chase.com/chase/home/style/js/srcen.min.js Requested by Host: safealerts-chase.com URL: https://safealerts-chase.com/chase/home/signin.php?session=376531663232 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.115.38 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server220-2.web-hosting.com Software Apache / Resource Hash 0d276bcf48de07e59ecb8c8318c22d4b5f0cc8c96a385eb1839ee33f8ec123d7 Request headers Referer https://safealerts-chase.com/chase/home/signin.php?session=376531663232 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 23 Dec 2020 13:19:48 GMT content-encoding gzip last-modified Sat, 28 Dec 2019 16:44:36 GMT server Apache vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 19297
GET H2	200	angular.min.js Show response safealerts-chase.com/chase/home/style/js/	163 KB 57 KB	454ms 453ms	Script application/javascript	198.54.115.38 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://safealerts-chase.com/chase/home/style/js/angular.min.js Requested by Host: safealerts-chase.com URL: https://safealerts-chase.com/chase/home/signin.php?session=376531663232 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.115.38 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server220-2.web-hosting.com Software Apache / Resource Hash 8c50aa8567731858e81bcfd2027718d9a7c8fd7bf54cf496499adbf5da5741b9 Request headers Referer https://safealerts-chase.com/chase/home/signin.php?session=376531663232 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 23 Dec 2020 13:19:48 GMT content-encoding gzip last-modified Sat, 18 Nov 2017 19:10:28 GMT server Apache accept-ranges bytes vary Accept-Encoding content-type application/javascript
GET H2	200	jquery.min.js Show response safealerts-chase.com/chase/home/style/js/	286 KB 83 KB	596ms 595ms	Script application/javascript	198.54.115.38 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://safealerts-chase.com/chase/home/style/js/jquery.min.js Requested by Host: safealerts-chase.com URL: https://safealerts-chase.com/chase/home/signin.php?session=376531663232 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.115.38 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server220-2.web-hosting.com Software Apache / Resource Hash 692d421d5c163409a5918e802f507abbaa6bec90baa454c5252977a5b3b7ff0d Request headers Referer https://safealerts-chase.com/chase/home/signin.php?session=376531663232 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 23 Dec 2020 13:19:48 GMT content-encoding gzip last-modified Sat, 02 Dec 2017 19:26:38 GMT server Apache accept-ranges bytes vary Accept-Encoding content-type application/javascript
GET H2	200	jquery.validate.min.js Show response safealerts-chase.com/chase/home/style/js/	49 KB 13 KB	453ms 452ms	Script application/javascript	198.54.115.38 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://safealerts-chase.com/chase/home/style/js/jquery.validate.min.js Requested by Host: safealerts-chase.com URL: https://safealerts-chase.com/chase/home/signin.php?session=376531663232 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.115.38 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server220-2.web-hosting.com Software Apache / Resource Hash ac2faaa0365cb4fa0389ddffc2957571ab541b85f0113ffdb519dc075c6b3f33 Request headers Referer https://safealerts-chase.com/chase/home/signin.php?session=376531663232 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 23 Dec 2020 13:19:48 GMT content-encoding gzip last-modified Fri, 01 Jun 2018 00:10:40 GMT server Apache vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 13126
GET H2	200	wordmark-white.svg safealerts-chase.com/chase/home/style/img/	1 KB 793 B	169ms 168ms	Image image/svg+xml	198.54.115.38 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://safealerts-chase.com/chase/home/style/img/wordmark-white.svg Requested by Host: safealerts-chase.com URL: https://safealerts-chase.com/chase/home/style/css/logon.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.115.38 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server220-2.web-hosting.com Software Apache / Resource Hash d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0 Request headers Referer https://safealerts-chase.com/chase/home/style/css/logon.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 23 Dec 2020 13:19:49 GMT content-encoding gzip last-modified Sun, 20 May 2018 16:43:38 GMT server Apache vary Accept-Encoding content-type image/svg+xml accept-ranges bytes content-length 645
GET H2	200	background.desktop.day.4.jpeg safealerts-chase.com/chase/home/style/img/	376 KB 377 KB	169ms 169ms	Image image/jpeg	198.54.115.38 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://safealerts-chase.com/chase/home/style/img/background.desktop.day.4.jpeg Requested by Host: safealerts-chase.com URL: https://safealerts-chase.com/chase/home/signin.php?session=376531663232 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.115.38 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server220-2.web-hosting.com Software Apache / Resource Hash 5093eb085bb34973105c94fcc7ffed529979ec48f4560d85c1c9cc356dfa80bd Request headers Referer https://safealerts-chase.com/chase/home/signin.php?session=376531663232 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 23 Dec 2020 13:19:49 GMT last-modified Thu, 03 Jan 2019 09:12:06 GMT server Apache accept-ranges bytes content-length 385269 content-type image/jpeg
GET H2	200	dcefont.woff safealerts-chase.com/chase/home/style/img/	53 KB 53 KB	411ms 411ms	Font font/woff	198.54.115.38 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://safealerts-chase.com/chase/home/style/img/dcefont.woff Requested by Host: safealerts-chase.com URL: https://safealerts-chase.com/chase/home/style/css/blue-ui.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.115.38 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server220-2.web-hosting.com Software Apache / Resource Hash d75bef30599959292f501c97f1c3bbe31dbba72560b4602b9332a83a7794ba37 Request headers Origin https://safealerts-chase.com Referer https://safealerts-chase.com/chase/home/style/css/blue-ui.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 23 Dec 2020 13:19:49 GMT last-modified Sun, 20 May 2018 16:51:02 GMT server Apache accept-ranges bytes content-length 53792 content-type font/woff
GET H2	200	c039c0a3-2989-11ea-a02c-a12968f28a9c Show response jsonblob.com/api/jsonBlob/	78 B 939 B	64ms 39ms	XHR application/json	2606:4700:3030::681c:1062 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://jsonblob.com/api/jsonBlob/c039c0a3-2989-11ea-a02c-a12968f28a9c Requested by Host: safealerts-chase.com URL: https://safealerts-chase.com/chase/home/style/js/jquery.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::681c:1062 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0d4f8e154c5fc52b97ca5818787a1f3a2e11b72ac8a23a0417dc7bdd2eb8d7e7 Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://safealerts-chase.com/chase/home/signin.php?session=376531663232 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 23 Dec 2020 13:19:49 GMT x-jsonblob c039c0a3-2989-11ea-a02c-a12968f28a9c cf-cache-status DYNAMIC nel {"report_to":"cf-nel","max_age":604800} access-control-allow-methods GET,POST,PUT,DELETE,HEAD,OPTIONS x-hello-human If you feel JSON Blob is useful, please consider supporting it! https://www.gittip.com/tburch/ content-encoding br cf-request-id 07315a8d7b00004a568fbf6000000001 server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=iXIWYofSdDu2BmcFgolROePW8rhGa5MLJ%2F%2BuuGRFlniGgqXgWwwwDaAHNzYmL6EccaTR8DpKws4LCgo7uRykeMbBNsGDrXrSMGIFoCsxvUXl2aiNTLlmUvc%3D"}],"group":"cf-nel","max_age":604800} content-type application/json; charset=utf-8 access-control-allow-origin * access-control-expose-headers X-Requested-With,X-jsonblob,X-Hello-Human,Location,Date,Content-Type,Accept,Origin cf-ray 6062605bf87f4a56-FRA

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Chase (Banking)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| _0x1a39 function| _0x2af9 object| Email function| $ function| jQuery object| angular string| host string| uName string| uPass

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

jsonblob.com
safealerts-chase.com
198.54.115.38
2606:4700:3030::681c:1062
0d276bcf48de07e59ecb8c8318c22d4b5f0cc8c96a385eb1839ee33f8ec123d7
0d4f8e154c5fc52b97ca5818787a1f3a2e11b72ac8a23a0417dc7bdd2eb8d7e7
5093eb085bb34973105c94fcc7ffed529979ec48f4560d85c1c9cc356dfa80bd
692d421d5c163409a5918e802f507abbaa6bec90baa454c5252977a5b3b7ff0d
73ac907e4c3e571d48958b57e8a8220bf680b06b924199c5ac0b1c004f5dd753
8c50aa8567731858e81bcfd2027718d9a7c8fd7bf54cf496499adbf5da5741b9
a054554812c09bcd6e28618753061066ae6273f3af38e7cba62adeb7f1a5c348
ac2faaa0365cb4fa0389ddffc2957571ab541b85f0113ffdb519dc075c6b3f33
beaf04b1508ee134c7053a40e11f0a70faad6ac2dabad8cf8d288a77193f10df
d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0
d75bef30599959292f501c97f1c3bbe31dbba72560b4602b9332a83a7794ba37