staticschase.business
Open in
urlscan Pro
93.157.63.225
Malicious Activity!
Public Scan
URL:
https://staticschase.business/securechaselogin/chaseonline.securechase.com/Logon.aspx/loadingmyaccounts.html
Submission: On May 11 via automatic, source openphish
Submission: On May 11 via automatic, source openphish
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 7 HTTP transactions.
The main IP is 93.157.63.225, located in
Russian Federation and
belongs to NFORCE, NL.
The main domain is staticschase.business.
TLS certificate: Issued by staticschase.business on May 10th 2020. Valid for: a year.
This is the only time staticschase.business was scanned on urlscan.io!
TLS certificate: Issued by staticschase.business on May 10th 2020. Valid for: a year.
This is the only time staticschase.business was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Chase (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 | 93.157.63.225 93.157.63.225 | 43350 (NFORCE) (NFORCE) | |
| 5 | 159.53.74.30 159.53.74.30 | 7743 (AS-7743) (AS-7743) | |
| 7 | 2 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 5 |
chase.com
chaseonline.chase.com |
7 KB |
| 2 |
staticschase.business
staticschase.business |
18 KB |
| 7 | 2 |
| Domain | Requested by | |
|---|---|---|
| 5 | chaseonline.chase.com |
staticschase.business
|
| 2 | staticschase.business |
staticschase.business
|
| 7 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.chase.com |
| chaseonline.chase.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| staticschase.business staticschase.business |
2020-05-10 - 2021-05-10 |
a year | crt.sh |
| apply.chase.com Entrust Certification Authority - L1M |
2020-03-04 - 2021-03-04 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://staticschase.business/securechaselogin/chaseonline.securechase.com/Logon.aspx/loadingmyaccounts.html
Frame ID: 04A85913BBBD27094E381D2445E53A22
Requests: 7 HTTP requests in this frame
Screenshot
Detected technologies
Windows Server
(Operating Systems)
Expand
Overall confidence: 50%
Detected patterns
Detected patterns
- html /<input[^>]+name="__VIEWSTATE/i
Microsoft ASP.NET
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- html /<input[^>]+name="__VIEWSTATE/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
IIS
(Web Servers)
Expand
Overall confidence: 50%
Detected patterns
Detected patterns
- html /<input[^>]+name="__VIEWSTATE/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
URL: http://www.chase.com/
Search URL Search Domain Scan URL
URL: https://chaseonline.chase.com/secure/LogOff.aspx
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
loadingmyaccounts.html
staticschase.business/securechaselogin/chaseonline.securechase.com/Logon.aspx/ |
7 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
index.css
staticschase.business/securechaselogin/chaseonline.securechase.com/Logon.aspx/ |
11 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ChaseNew.gif
chaseonline.chase.com/images// |
742 B 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logoff.gif
chaseonline.chase.com/images/ |
1 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bolprogress.gif
chaseonline.chase.com/images/ |
371 B 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
headerback.gif
chaseonline.chase.com/Themes/default/images/ |
323 B 922 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
headertext.gif
chaseonline.chase.com/Themes/default-col/images/ |
580 B 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Chase (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
chaseonline.chase.com
staticschase.business
159.53.74.30
93.157.63.225
119c8f4ce00a48b0578d58487cbfd7bf1a2ead81cdaf193624b44f0202ef2b38
2a91c7f2487148a2094b0defe62f23cd40df2c0c4724e042718a7a09fdef48e0
38f725798cc838d0b61be012cd645024617d8b72add9dc207d5a20e95a12fc18
5a943b9b605a7465fa37d9d7b5efdc23700e4f123c1ebe8a47b6fc51558ac36c
728072e34298a7162a370b1edb3666d90dc8cbf1e8240887601e258d44936915
bd6879bde7017ddd21eb97083f009356b741f4ad1c5e3dac0e7b81f14b1bce4b
d82b8b41b5b6bcd2069fd19593e54bae7af16be3458f9765ffc30aee5b5a187f