www.drsamuel.org - urlscan.io

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 7 HTTP transactions. The main IP is 132.148.192.27, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US. The main domain is www.drsamuel.org.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on March 7th 2019. Valid for: a year.

This is the only time www.drsamuel.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Chase (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 6	132.148.192.27 132.148.192.27	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
1	159.53.42.34 159.53.42.34	7743 (AS-7743) (AS-7743 - JPMorgan Chase & Co.)
7	3

6 132.148.192.27 (Scottsdale, United States) 1 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-132-148-192-27.ip.secureserver.net

www.drsamuel.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 159.53.42.34 (United States)

ASN7743 (AS-7743 - JPMorgan Chase & Co., US)

chaseonline.chase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	drsamuel.org 1 redirects www.drsamuel.org	57 KB
1	chase.com chaseonline.chase.com	1 KB
7	2

	Domain	Requested by
6	www.drsamuel.org	1 redirects www.drsamuel.org
1	chaseonline.chase.com	www.drsamuel.org
7	2

This site contains no links.

Subject Issuer	Validity	Valid
drsamuel.org Go Daddy Secure Certificate Authority - G2	`2019-03-07` - `2020-03-07`	a year	crt.sh
apply.chase.com Entrust Certification Authority - L1M	`2019-03-21` - `2020-03-21`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/
Frame ID: 28092A26CCC1941A8DF24F1136A73DFF
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/index.php HTTP 301
https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/ Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

7
Requests

86 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

58 kB
Transfer

363 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/index.php HTTP 301
https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/
Redirect Chain

https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/index.php
https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/

11 KB
4 KB

189ms
188ms

Document
text/html

132.148.192.27
GoDaddy.com

General

Check archive.org

Show headers Download Go to

Full URL: https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 132.148.192.27 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-132-148-192-27.ip.secureserver.net
Software: Apache /
Resource Hash: 9d666f50ebe8c9809d552b2d4f6983a92049441b310326e913a9b23a2832762c

Request headers

:method: GET
:authority: www.drsamuel.org
:scheme: https
:path: /wp-content/plugins/cherry-popups/templates/Chase/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
accept-encoding: gzip, deflate, br
cookie: PHPSESSID=fv4mkcjfm0a9ik05h64jldf7p2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Fri, 12 Jul 2019 02:57:47 GMT
server: Apache
last-modified: Fri, 21 Dec 2018 05:29:18 GMT
etag: "2a75-57d8187506780-gzip"
accept-ranges: bytes
cache-control: max-age=3600
expires: Fri, 12 Jul 2019 03:57:47 GMT
vary: Accept-Encoding,User-Agent
content-encoding: gzip
referrer-policy
content-length: 3492
content-type: text/html

Redirect headers

status: 301
date: Fri, 12 Jul 2019 02:57:38 GMT
server: Apache
x-powered-by: PHP/7.0.33
pragma: no-cache
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
x-redirect-by: WordPress
set-cookie: PHPSESSID=fv4mkcjfm0a9ik05h64jldf7p2; path=/
vary: Accept-Encoding,User-Agent
location: https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/
referrer-policy
content-length: 0
content-type: text/html; charset=UTF-8

GET
H2 200 appConfig.js Show response
www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/css%20js/ 11 KB
3 KB 1009ms
1005ms Script
application/x-javascript 132.148.192.27
GoDaddy.com

General

Check archive.org

Show headers Download Go to

Full URL: https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/css%20js/appConfig.js
Requested by: Host: www.drsamuel.org
URL: https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 132.148.192.27 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-132-148-192-27.ip.secureserver.net
Software: Apache /
Resource Hash: a0ff0feed10a8e21e566ab538008e58c55d6eeaad8c8ea7efcd36d2633726c3e

Request headers

Referer: https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 12 Jul 2019 02:57:47 GMT
content-encoding: gzip
referrer-policy
last-modified: Thu, 11 Jan 2018 23:30:42 GMT
server: Apache
etag: "2d4c-56288894aac80-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 2978
expires: Sat, 11 Jul 2020 02:57:47 GMT

GET ss.js
www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/css%20js/ 0
0

GET
H2 200 blue-ui.css
www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/css%20js/ 258 KB
37 KB 1130ms
1126ms Stylesheet
text/css 132.148.192.27
GoDaddy.com

General

Check archive.org

Show headers Download Go to

Full URL: https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/css%20js/blue-ui.css
Requested by: Host: www.drsamuel.org
URL: https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 132.148.192.27 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-132-148-192-27.ip.secureserver.net
Software: Apache /
Resource Hash: 80a18543ba3fff90a23a10df2d435680fcefee6c962dd9d20ab3f51c2abaf162

Request headers

Referer: https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 12 Jul 2019 02:57:47 GMT
content-encoding: gzip
referrer-policy
last-modified: Fri, 15 Sep 2017 22:07:40 GMT
server: Apache
etag: "40697-559419f112300-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 37579
expires: Sat, 11 Jul 2020 02:57:47 GMT

GET
H2 200 logon.css
www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/css%20js/ 82 KB
13 KB 1024ms
1020ms Stylesheet
text/css 132.148.192.27
GoDaddy.com

General

Check archive.org

Show headers Download Go to

Full URL: https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/css%20js/logon.css
Requested by: Host: www.drsamuel.org
URL: https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 132.148.192.27 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-132-148-192-27.ip.secureserver.net
Software: Apache /
Resource Hash: 13aa9ff522d67f8b784fbc58a23ad97fb87dbbcf31dcc727fe896547d0c3e5cf

Request headers

Referer: https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 12 Jul 2019 02:57:47 GMT
content-encoding: gzip
referrer-policy
last-modified: Wed, 31 Jan 2018 22:50:32 GMT
server: Apache
etag: "149db-5641a4e787e00-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 12868
expires: Sat, 11 Jul 2020 02:57:47 GMT

GET
H/1.1 200
OK ChaseNew.gif
chaseonline.chase.com/images// 742 B
1 KB 998ms
90ms Image
image/gif 159.53.42.34
JPMorgan Chase & Co.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://chaseonline.chase.com/images//ChaseNew.gif

Requested by

Host: www.drsamuel.org
URL: https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

159.53.42.34 , United States, ASN7743 (AS-7743 - JPMorgan Chase & Co., US),

Reverse DNS

Software

/

Resource Hash

d82b8b41b5b6bcd2069fd19593e54bae7af16be3458f9765ffc30aee5b5a187f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 12 Jul 2019 02:31:23 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 28 Mar 2005 18:52:40 GMT
Server
Age: 1585
X-Powered-By
WAMI: 395
Content-Type: image/gif
Access-Control-Allow-Origin: https://m.chase.com
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=14400
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 742
ETag: "0cfa50c733c51:0"

GET
H2 200 Capture.PNG
www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/css%20js/ 632 B
750 B 1002ms
998ms Image
image/png 132.148.192.27
GoDaddy.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/css%20js/Capture.PNG
Requested by: Host: www.drsamuel.org
URL: https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 132.148.192.27 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-132-148-192-27.ip.secureserver.net
Software: Apache /
Resource Hash: 774da4f67a524dd237c2feeb02b64dece2e23fb3f8272f17e121ebf8e78ef174

Request headers

Referer: https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 12 Jul 2019 02:57:47 GMT
referrer-policy
last-modified: Sat, 03 Feb 2018 02:32:48 GMT
server: Apache
etag: "278-56445a50a7400"
content-type: image/png
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 632
expires: Sat, 11 Jul 2020 02:57:47 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.drsamuel.org
URL: https://www.drsamuel.org/wp-content/plugins/cherry-popups/templates/Chase/css%20js/ss.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Chase (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

chaseonline.chase.com
www.drsamuel.org
www.drsamuel.org
132.148.192.27
159.53.42.34
13aa9ff522d67f8b784fbc58a23ad97fb87dbbcf31dcc727fe896547d0c3e5cf
774da4f67a524dd237c2feeb02b64dece2e23fb3f8272f17e121ebf8e78ef174
80a18543ba3fff90a23a10df2d435680fcefee6c962dd9d20ab3f51c2abaf162
9d666f50ebe8c9809d552b2d4f6983a92049441b310326e913a9b23a2832762c
a0ff0feed10a8e21e566ab538008e58c55d6eeaad8c8ea7efcd36d2633726c3e
d82b8b41b5b6bcd2069fd19593e54bae7af16be3458f9765ffc30aee5b5a187f

www.drsamuel.org Open in urlscan Pro 132.148.192.27 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

86 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

58 kBTransfer

363 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

Indicators

www.drsamuel.org Open in urlscan Pro
132.148.192.27 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

86 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

58 kB
Transfer

363 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!